How to Enable LSA Protection in Windows 11
LSA Protection (Local Security Authority Protection) in Windows 11 stops unauthorized software from reading your login details and passwords from computer memory. This built-in security feature runs on Windows 11 version 21H2 and later, using a technology called Protected Process Light (PPL) to lock down the LSASS.exe process.
Turning on LSA Protection blocks hackers from stealing your credentials during an attack, giving you an extra layer of defense for your personal data.
Enable LSA Protection by opening Windows Security, navigating to Device security, then Core isolation, and toggling Local Security Authority protection to On. This requires UEFI and Secure Boot to be enabled in your BIOS.
Hardware Prerequisites
Before enabling this, ensure your PC meets these requirements:
- UEFI and Secure Boot: Your computer must be set to UEFI mode with Secure Boot enabled in your BIOS settings.
- Windows 11 22H2 or newer: This feature is fully integrated into recent versions of Windows 11.
How to Verify if LSA Protection is Active
LSA Protection Windows 11 status can be checked in a few seconds using Task Manager to see if Local Security Authority protection is running. You need to look for a specific setting linked to the system process called lsass.exe. This confirms whether Windows is actively guarding your login details against theft.
- Press Ctrl+Shift+Esc to open Task Manager .
- Go to the Details tab.
- Right-click the column headers and select Select columns.
- Check the box for Elevated or Protected Process.
- Find lsass.exe in the list. If it shows as a protected process, the feature is active.
Troubleshooting and Compatibility
If you experience system instability, you may need to disable the feature or update your drivers.
Enable or Disable LSA via Windows Security
This is the easiest way to manage your settings. Requires admin privileges.
- Click the Start menu and type Windows Security. Select the app.
windows security app search on start menu - Click Device security on the left menu.
windows 11 security app device security option - Click the Core isolation details link.
windows 11 core isolation details link - Find Local Security Authority protection. Toggle the switch to On.
windows local security authority protection button
Enable or Disable LSA via Registry Editor
Requires admin privileges. Use caution when editing the registry.
- Open the Registry Editor.
- Go to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
windows local security authority protection windows registry - Right-click in the empty space, select New DWORD (32-bit) Value, and name it
RunAsPPL. - Set the Value data to
1to enable or0to disable.
windows local security authority protection windows registry value data
Enable or Disable LSA via Group Policy
Requires admin privileges.
- Open the Local Group Policy editor.
- Go to: Computer Configuration Administrative Templates System Local Security Authority.
windows local security authority protection local group policy editor - Double-click Configure LSASS to run as protected process and set it to Enabled.
windows local security authority protection local group policy editor options
For advanced technical details, visit the official Microsoft Learn documentation.
Summary
LSA Protection in Windows 11 is a key security feature that stops bad programs from stealing your passwords and login info.
Why is LSA Protection missing from my Windows Security settings?
If you can't find the LSA Protection setting in Windows Security, it's likely because your computer's hardware doesn't support it or needs a quick update.
What is the difference between LSA protection and Credential Guard?
LSA Protection uses PPL to stop unauthorized processes from accessing the LSASS process. Credential Guard goes further by using virtualization-based security to isolate secrets in a separate container that even the operating system kernel cannot access. Both work together to provide a layered defense against credential theft.
Was this guide helpful?
About the Author
Richard
Tech Writer, IT Professional
Richard, a writer for Geek Rewind, is a tech enthusiast who loves breaking down complex IT topics into simple, easy-to-understand ideas. With years of hands-on experience in system administration and enterprise IT operations, he’s developed a knack for offering practical tips and solutions. Richard aims to make technology more accessible and actionable. He's deeply committed to the Geek Rewind community, always ready to answer questions and engage in discussions.
No comments yet — be the first to share your thoughts!