Windows

How to Enable LSA Protection in Windows 11

Written by

Richard

Dec 12, 2022 Updated Apr 30, 2026 3 min read

Enabling LSA (Local Security Authority) Protection in Windows 11 adds a crucial layer of security to safeguard your login credentials.

LSA Protection is a security feature that protects the LSASS.exe process, which handles your login information and security tokens, from unauthorized access.

It uses Protected Process Light (PPL) technology to prevent malicious code from injecting itself and stealing or altering your sensitive data, significantly enhancing your PC’s defense against credential theft.

By turning on LSA Protection, you make it much harder for attackers to access your system’s memory and steal your usernames and passwords.

This advanced security measure is available in Windows 11 builds starting from 21H2 and requires a system restart to activate fully.

Hardware Prerequisites

Before enabling this, ensure your PC meets these requirements:

UEFI and Secure Boot: Your computer must be set to UEFI mode with Secure Boot enabled in your BIOS settings.
Windows 11 22H2 or newer: This feature is fully integrated into recent versions of Windows 11.

How to Verify if LSA Protection is Active

You can check if the protection is running in Task Manager:

Press Ctrl+Shift+Esc to open Task Manager.
Go to the Details tab.
Right-click the column headers and select Select columns.
Check the box for Elevated or Protected Process.
Find lsass.exe in the list. If it shows as a protected process, the feature is active.

Troubleshooting and Compatibility

Warning: Enabling LSA Protection may cause issues with older, unsigned third-party drivers. If you experience system instability, you may need to disable the feature or update your drivers.

Enable or Disable LSA via Windows Security

This is the easiest way to manage your settings. Requires admin privileges.

Click the Start menu and type Windows Security. Select the app.
Click Device security on the left menu.
Click the Core isolation details link.
Find Local Security Authority protection. Toggle the switch to On.

Enable or Disable LSA via Registry Editor

Requires admin privileges. Use caution when editing the registry.

Open the Registry Editor.
Go to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
Right-click in the empty space, select New > DWORD (32-bit) Value, and name it RunAsPPL.
Set the Value data to 1 to enable or 0 to disable.

Enable or Disable LSA via Group Policy

Requires admin privileges.

Open the Local Group Policy editor.
Go to: Computer Configuration > Administrative Templates > System > Local Security Authority.
Double-click Configure LSASS to run as protected process and set it to Enabled.

For advanced technical details, visit the official Microsoft Learn documentation.

Summary

LSA Protection is a vital security layer that blocks unauthorized code from accessing your login credentials. By ensuring your hardware supports UEFI and Secure Boot, you can enable this feature via Windows Security, the Registry, or Group Policy. This simple step significantly improves your system’s resistance to credential theft and malicious code injection.

Why is LSA Protection missing from my Windows Security settings?

If the option is missing, your hardware might not support it. Ensure your BIOS has UEFI and Secure Boot enabled. Additionally, if you are running an older version of Windows 11, you may need to update your system to version 22H2 or later to see the toggle in the security dashboard.

What is the difference between LSA protection and Credential Guard?

LSA Protection uses PPL to stop unauthorized processes from accessing the LSASS process. Credential Guard goes further by using virtualization-based security to isolate secrets in a separate container that even the operating system kernel cannot access. Both work together to provide a layered defense against credential theft.

Was this guide helpful?

Tags: #Windows 11

Was this helpful?

About the Author

Richard

Tech Writer, IT Professional

Richard, a writer for Geek Rewind, is a tech enthusiast who loves breaking down complex IT topics into simple, easy-to-understand ideas. With years of hands-on experience in system administration and enterprise IT operations, he’s developed a knack for offering practical tips and solutions. Richard aims to make technology more accessible and actionable. He's deeply committed to the Geek Rewind community, always ready to answer questions and engage in discussions.

2568 articles → Twitter