How to Enable LSA Protection in Windows 11

Hardware Prerequisites

Before you enable this, make sure your PC meets the requirements below. If one is missing, the switch in Windows Security can be greyed out or missing, or the protection may not start after a restart.

• UEFI and Secure Boot: Your computer must be set to UEFI mode with Secure Boot enabled in your BIOS settings. If your PC still boots in legacy (BIOS/CSM) mode, change that in the firmware setup first.
• Windows 11 22H2 or newer: This feature is fully integrated into recent versions of Windows 11. To see which version you run, go to Settings › System › About and look under Windows specifications.

How to Verify if LSA Protection is Active

You can check the LSA Protection status in a few seconds using Task Manager 📊. It shows whether Local Security Authority protection is running. You look for a specific setting linked to the system process called lsass.exe. This confirms whether Windows is actively guarding your login details against theft.

1. Press Ctrl+Shift+Esc to open Task Manager 📊. If it opens in a compact view, click More details at the bottom left to see all the tabs.
2. Go to the Details tab. You should see a list of every running process with its process ID (PID).
3. Right-click the column headers and select Select columns. A window opens with a list of columns you can add.
4. Check the box for Elevated or Protected Process, then click OK. A new column appears in the Details list.
5. Find lsass.exe in the list. If it shows as a protected process, the feature is active. If the column is not offered on your build, or the result is unclear, use the Windows Security page described below instead. It shows the switch state directly.

Troubleshooting and Compatibility

Security plug-ins that load into LSASS must be properly signed to load once the process is protected. If you experience system instability, you may need to disable the feature or update your drivers.

Each method below says how to switch the feature back off. Any change to this setting only takes effect after a restart.

Enable or Disable LSA via Windows Security

This is the easiest way to manage your settings, and it works on Home, Pro, Enterprise and Education. Requires admin privileges.

1. Click the Start menu and type Windows Security. Select the app. The Windows Security home page opens.

   

2. Click Device security on the left menu. You should see sections such as Core isolation and Security processor.

   

3. Click the Core isolation details link. The Core isolation page opens with its list of switches.

   

4. Find Local Security Authority protection. Toggle the switch to On. Approve the User Account Control prompt if one appears. Windows then asks you to restart, so save your work and restart the PC to finish. To undo this later, set the switch back to Off and restart again.

   

Enable or Disable LSA via Registry Editor

Requires admin privileges. Use caution when editing the registry. A wrong change can cause problems, so back up the registry first: in Registry Editor, choose File › Export and save a copy. Use this method if the switch in Windows Security is missing or you need to script the change.

1. Open the Registry Editor. Search for it in the Start menu and choose Run as administrator. Approve the User Account Control prompt.
2. Go to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa The key opens in the right pane, where its existing values are listed.

   

3. Right-click in the empty space, select New › DWORD (32-bit) Value, and name it RunAsPPL. If a value with that name already exists, skip this step and double-click the existing value instead.
4. Set the Value data to 1 to enable or 0 to disable, then click OK. Restart the PC so the change takes effect. To undo it later, set the value to 0 and restart.

   

Enable or Disable LSA via Group Policy

Requires admin privileges. The Local Group Policy editor is included in Windows 11 Pro, Enterprise and Education. It is not available on Home, so Home users should use one of the methods above.

1. Open the Local Group Policy editor. Search for Edit group policy in the Start menu and select it. The editor opens with a policy tree on the left.
2. Go to: Computer Configuration › Administrative Templates › System › Local Security Authority. The policies in that folder appear in the right pane. If you cannot find the policy below, your Windows build may not include it.

   

3. Double-click Configure LSASS to run as protected process and set it to Enabled. Click OK, then restart the PC. If the policy offers a choice with a UEFI lock, note that the lock makes the setting harder to remove later. To undo the change, set the policy to Not Configured or Disabled and restart.

   

For advanced technical details, visit the official Microsoft Learn documentation.

Summary

LSA Protection in Windows 11 is a key security feature that stops bad programs from stealing your passwords and login info. The quickest way to turn it on is the switch in Windows Security, followed by a restart. Use the registry or Group Policy if you need to manage it on several PCs or the switch is not available. If a driver or security tool stops working afterward, update it or turn the protection off and restart.