Fix Local Security Authority Protection Is Off in Windows 11

If you see “Local Security Authority protection is off” in Windows Security, the fix is to turn it back on in the Windows Security app, and if that fails, repair the underlying system files or registry entries. This article explains exactly how to do that, why the setting matters, and what to do when the toggle won’t stay on.

What Is Local Security Authority Protection?

Local Security Authority (LSA) is a core Windows process that handles sign-in verification, password checks, and security tokens. LSA protection (also called “LSA protection” or “Run as PPL”) is a security feature that prevents other processes from reading LSA’s memory or injecting code into it. When enabled, LSA runs as a Protected Process Light (PPL), which means even administrators cannot easily tamper with it without rebooting into a special mode. This makes it much harder for malware to steal credentials or bypass authentication.

Windows 11 enables LSA protection by default on new installations, but some updates, third-party security software, or manual changes can turn it off. When it’s off, Windows Security shows a yellow warning banner and recommends you turn it back on.

Why Does the Warning Appear?

The warning appears when the LSA protection setting is not active. This can happen for several reasons:

• A Windows update reset the setting or a driver update changed the registry value.
• Third-party security software (especially older antivirus or anti-cheat tools) disabled it for compatibility.
• You or another user manually turned it off in Windows Security or via the registry.
• A system file corruption or a failed update left the setting in a broken state.

When the warning is present, Windows Security still works, but your device is more exposed to credential theft attacks. The warning is not an indication that your system is already infected—it simply means the protection is not active.

How to Turn LSA Protection Back On

The standard way to fix this is through the Windows Security app:

1. Open Windows Security (search for it in the Start menu).
2. Select Device security from the left sidebar.
3. Under Core isolation, click Core isolation details.
4. Find Local Security Authority protection and toggle it to On.
5. Restart your PC when prompted.

If the toggle is grayed out or turns itself off after a restart, continue to the next steps.

What to Do If the Toggle Won’t Stay On

Sometimes the switch appears on, but after a reboot the warning returns. This usually means the registry value was changed or a conflicting program is forcing it off. Try these fixes in order:

1. Check the registry value: Press Win + R, type regedit, and navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa. Look for a DWORD value named RunAsPPL. If it exists, set it to 2 (which enables LSA protection). If it doesn’t exist, create a new DWORD (32-bit) and name it RunAsPPL, then set it to 2. Restart your PC.
2. Run System File Checker: Open Command Prompt as administrator (search “cmd”, right-click, “Run as administrator”) and run sfc /scannow. This repairs corrupted system files. After it finishes, restart and check if the warning is gone.
3. Run DISM: If SFC doesn’t help, run DISM /Online /Cleanup-Image /RestoreHealth in the same Command Prompt window. This fixes Windows image corruption. Restart after it completes.
4. Check for conflicting software: If you recently installed an antivirus or anti-cheat program, uninstall it temporarily and see if the toggle stays on. If it does, contact the software vendor for an updated version that supports LSA protection.
5. Perform a Windows update: Go to Settings > Windows Update and install any pending updates. Microsoft has fixed several bugs related to LSA protection in cumulative updates.

How to Check If LSA Protection Is Actually Running

Even if the Windows Security toggle says “On,” you can verify that LSA is running as a protected process. Open Command Prompt as administrator and run:

reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL

If the output shows RunAsPPL REG_DWORD 0x2, then LSA protection is enabled. If it shows 0x0 or the value is missing, it’s off. You can also use PowerShell to check the process protection status, but the registry query is the simplest method.

Common Misconceptions and Pitfalls

One common misconception is that LSA protection is the same as Memory Integrity (also called Hypervisor-protected Code Integrity, or HVCI). They are separate features under Core isolation. Memory Integrity protects kernel code, while LSA protection protects the LSA process. You can have one on and the other off. Both are recommended, but they can be enabled independently.

Another pitfall is setting the registry value to 1 instead of 2. The value 1 enables LSA protection but allows debugging, which weakens the protection. Microsoft uses 2 for full protection. Always use 2.

Some users worry that enabling LSA protection will break older drivers or games. In practice, this is rare. If you encounter a compatibility issue, you may need to update the driver or the game. Disabling LSA protection permanently is not recommended, but if you must, you can set the registry value to 0 and restart.

Frequently Asked Questions

Why does LSA protection turn off by itself?

It can turn off after a Windows feature update, a driver update, or when a third-party security program modifies the registry. Sometimes a corrupted system file or a failed update can also reset the setting. Running SFC and DISM often resolves the underlying issue.

Is it safe to edit the registry to enable LSA protection?

Editing the registry is safe if you follow the exact steps and only change the RunAsPPL value. Incorrect registry edits can cause system instability, so back up the registry before making changes. If you’re not comfortable with the registry, use the Windows Security toggle instead.

Will enabling LSA protection slow down my PC?

No noticeable performance impact. LSA protection adds a small overhead to the authentication process, but it is negligible on modern hardware. You won’t see a difference in everyday tasks or gaming.

Can I enable LSA protection on Windows 10?

Yes, the feature exists in Windows 10 version 1809 and later. The steps are the same: Windows Security > Device security > Core isolation > Local Security Authority protection. On older builds, you may need to enable it via the registry.

What if the toggle is grayed out?

A grayed-out toggle usually means your device doesn’t meet the hardware requirements (e.g., virtualization support) or a group policy is forcing the setting. Check if your CPU supports virtualization and that it’s enabled in BIOS. If you’re on a managed work PC, the policy may be controlled by your IT department.

Does LSA protection prevent all credential theft?

No, but it significantly raises the bar. It protects against many memory-injection attacks, but sophisticated malware that runs as a kernel driver or exploits a zero-day vulnerability could still bypass it. It’s one layer of defense, not a silver bullet.

Related

• Solved Windows 10 Slow Shutdown? Fixes That Work
• Can’t Remove Windows Device from Microsoft Account? Fix
• macOS Sequoia Writing Assistant: How to Use It