Windows 11 LSA Protection Warning: Meaning & Fix

The “LSA protection is off” warning in Windows 11 Security indicates that Local Security Authority (LSA) protection, a security feature that prevents untrusted processes from reading or tampering with system credentials, is disabled. You can fix it by turning on LSA protection in Windows Security under Device Security > Core isolation, or by enabling it via the Registry or Group Policy, then restarting your PC.

What Is LSA Protection and Why Does It Matter?

LSA (Local Security Authority) is a Windows subsystem that handles authentication, logon validation, and the generation of security tokens. It is a high-value target for attackers because it stores or processes sensitive credential material, including password hashes and Kerberos tickets. LSA protection, introduced in Windows 8.1 and enabled by default in Windows 11, adds an extra layer by marking the LSA process as protected, preventing non-Microsoft processes from injecting code or reading its memory. When this protection is off, malware that gains admin privileges could use tools like Mimikatz to dump credentials from memory, leading to lateral movement across a network.

The warning appears in the Windows Security app under Device security > Core isolation, and sometimes as a notification. It is not a sign that your system is already compromised, but rather that a security hardening feature is not active. On a fresh Windows 11 install, LSA protection is usually on by default. However, it may be disabled if you upgraded from an older version, a driver or application turned it off, or a group policy overrode it.

How LSA Protection Works Under the Hood

LSA protection uses a Windows security mechanism called Protected Process Light (PPL). When LSA runs as a PPL, the kernel prevents any process from opening the LSA process handle with access rights that would allow reading memory or injecting threads, unless the requesting process is itself signed with a specific Microsoft certificate and meets additional requirements. This significantly raises the bar for credential theft.

In Windows 11, LSA protection is controlled by a registry value named RunAsPPL under HKLM\SYSTEM\CurrentControlSet\Control\Lsa. Setting it to 1 enables protection, 2 enables it with additional signing requirements (used by some enterprise configurations), and 0 disables it. The Windows Security UI toggles this value, but a group policy setting can override it. If the policy is set to “Not Configured”, the UI toggle works; if set to “Enabled” or “Disabled”, the UI may be greyed out and the policy takes precedence.

How to Fix the LSA Protection Warning

There are two primary methods to enable LSA protection: through the Windows Security interface or via Registry/Group Policy. The UI method is simplest for most users.

Open Windows Security (search for it in the Start menu).
Select Device security on the left sidebar.
Under Core isolation, click Core isolation details.
Toggle Local Security Authority protection to On.
Restart your PC when prompted.

If the toggle is greyed out or the setting doesn’t stick, use the Registry method:

Press Win+R, type regedit, and press Enter.
Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa.
Right-click on the right pane, select New > DWORD (32-bit) Value.
Name it RunAsPPL and set its value to 1.
Click OK and restart your PC.

For systems managed by an organization, the Group Policy Editor (gpedit.msc) can be used: go to Computer Configuration > Administrative Templates > System > Local Security Authority, enable the setting “Configure LSA protection”, and set it to “Enabled” with the option “Enabled with UEFI Lock” if supported. After any change, a restart is required.

Common Problems and Troubleshooting

If the toggle in Windows Security is greyed out, it’s often because a group policy is overriding it. Check the Local Group Policy Editor as described above and set it to “Not Configured” if you want to use the UI toggle. Another possibility is that your device’s firmware (UEFI) doesn’t support the required virtualization-based security features, though LSA protection itself does not require virtualization. If you see an error after enabling, such as “LSA protection cannot be enabled,” it may be due to incompatible drivers or a corrupted system file. Running sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth in an elevated Command Prompt can repair system files.

Some third-party security software or older drivers may conflict with LSA protection, causing instability or preventing the system from booting. In such cases, you’ll need to update the problematic driver or software, or temporarily disable LSA protection to regain access. A common misconception is that LSA protection slows down your PC; in practice, the performance impact is negligible because it only adds checks at process creation and handle opening, not during normal authentication operations.

When You Might Want to Leave It Off

There are very few legitimate reasons to disable LSA protection. Some enterprise environments disable it to accommodate legacy authentication plugins or single sign-on solutions that are not compatible with PPL. If you run such software, you may need to weigh the security risk. However, for the vast majority of home and business users, leaving LSA protection off exposes you to unnecessary credential theft risk. If you are in a managed environment, check with your IT department before changing the setting, as they may have a reason for the current configuration.

Comparison: LSA Protection vs. Credential Guard

LSA protection is often confused with Windows Defender Credential Guard, but they are different features. Credential Guard uses virtualization-based security to isolate the LSA process in a separate virtualized container, providing even stronger protection because the isolated process runs in a secure world that the OS cannot directly access. LSA protection, on the other hand, is a lighter mechanism that relies on PPL without virtualization. Credential Guard is only available on enterprise editions of Windows 11 and requires specific hardware (Virtualization-Based Security). LSA protection works on all editions and is a baseline hardening step. Microsoft recommends enabling both when possible, but LSA protection is the more universally applicable control.

Frequently Asked Questions

Why is LSA protection off by default on my Windows 11?

On a clean installation of Windows 11, LSA protection is typically enabled by default. If it’s off, it may be because you upgraded from Windows 10 (where it was often not enabled), a driver or application disabled it, or a group policy is overriding it. Check the policy settings and enable it via the UI or registry.

Does enabling LSA protection require a restart?

Yes, a restart is required for the change to take effect. The LSA process must be re-initialized with the new protection level, and that only happens at boot time.

Can I enable LSA protection on Windows 11 Home?

Yes, LSA protection is available on all editions of Windows 11, including Home. The UI toggle works, and the registry method works as well. It does not require Pro or Enterprise.

What happens if I ignore the LSA protection warning?

Ignoring the warning leaves your system with a known security weakness that could be exploited by malware to steal credentials. It doesn’t mean you are immediately at risk, but it increases the likelihood of credential theft if your system is compromised. It’s recommended to enable it.

Will enabling LSA protection break my existing applications?

Rarely, but it can. Some legacy authentication plugins, password managers, or security software that need to interact with the LSA process may fail. If you encounter such issues, you may need to update the software or disable LSA protection. In practice, most modern applications are compatible.

How do I check if LSA protection is enabled?

Open Windows Security > Device security > Core isolation details. The status of “Local Security Authority protection” will show as On or Off. You can also open an elevated PowerShell and run Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "RunAsPPL". If the value is 1, it’s enabled; if 0 or missing, it’s off.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →