If you want to make sure your Windows 11 computer is safe from certain attacks, it helps to check if LSA Protection is turned on.

What is LSA Protection?

LSA stands for Local Security Authority. It’s a part of Windows that helps keep your computer’s security information safe, like your passwords and login details.

LSA Protection makes sure this important part of your computer is extra secure by running it in a special protected mode. This makes it harder for hackers or bad software to tamper with it.

Windows also has another protection called Core Isolation, which works in a similar way to keep your PC safe.

How to Check if LSA Protection is On

You can check if LSA Protection is working by looking at your computer’s event logs using a tool called Event Viewer. Here’s how:

1. Open Event Viewer:
   
   Click the Start button, type eventvwr.msc, and press Enter.
   

   
   

2. Find System Logs:
   In the left panel, click the arrow next to Windows Logs to expand it, then click on System.
   
3. Filter the Logs:
   
   Right-click on System and choose Filter Current Log…
   

   
   

4. Enter Filter Details:
   In the filter box, type 12 in the Event IDs box.
   Then, click the dropdown for Event sources and select Wininit.
   
   Click OK.
   

   
   

5. Check the Log Message:
   Look for a message that says:
   
   “LSASS.exe was started as a protected process with level 4”.
   
   This means LSA Protection is active on your PC.
   

   
   

That’s it! If you see that message, your computer is better protected against attacks targeting the security process.

Why Does This Matter?

• LSA Protection helps keep your computer’s security info safe from hackers.
• Checking this yourself gives you peace of mind that your PC is secure.
• It’s a good habit to check security features regularly to stay protected.

If you want to learn more about Windows security features, check out this guide on Core Isolation.