Share via

Local Security Authority Protection turned off, how?

Anonymous
2024-12-15T22:11:56+00:00

I was on my daughters PC (Win 11 home, 24H2 fully patched) and noticed in sys tray the Windows security icon was not ticked.
So I opened it, and drilled down the unticked items to find that the Local Security Authority Protection was not enabled.
I check her PC a lot, and am sure that the Windows security Icon was ticked last time I checked...
So I enabled it... and rebooted, and all fine, however, I was going to shout at her along the lines of "how did that get disabled? you should have got an alert... dont ever allow anything turn that off without checking with me".
Anyway - I now on my PC (Win 11 Pro, 24H2 fully patched) and I checked my sys tray and Windows security icon ticked.. but I open it... and for me, it also showed that core isolation was not fully ticked, and drilling down it also said for me that Local Security Authority Protection was off, but the switch showed it was turned on, but a message said I needed to reboot to enable it. So I rebooted and so its now showing as enabled again.

But WHAT THE HELL is going on? how can this happen? I saw a previous message suggesting a duff Defender update may have caused in the past.

Anyone know whats going on here?
Thanks in advance

Windows for home | Windows 11 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous
2024-12-16T09:11:39+00:00

Dear Justin,

Welcome to the Microsoft Community

It appears that you've noticed the "Local Security Authority (LSA) Protection" turned off on both your daughter's and your own PC running Windows 11. It's concerning when feature is unexpectedly disabled, and it’s prudent to understand the cause and ensure it doesn’t happen again.

Possible Reasons Why LSA Protection Was Disabled

  • Windows Defender Update Issues: Occasionally, Windows Defender or other security updates can mistakenly disable certain security settings. This has happened in the past due to faulty updates.
  • Third-Party Software: Some third-party software, especially those related to security or system optimization, might inadvertently alter security settings.
  • Incomplete Windows Updates: Windows updates might apply partially or improperly, leading to temporarily disabled security features until a reboot or subsequent update completes correctly.

Third-Party Software Check:

  • Review recently installed or updated applications for any potential conflicts.
  • Pay special attention to security software or system optimization tools.
  • Temporarily disable or uninstall these applications to see if the issue resolves.

Enable LSA Protection Manually via Registry: Enabling LSA protection through the Windows Security app doesn’t make the necessary changes. Manually updating the registry can ensure it’s set correctly:

Warning: Be careful when editing the registry. Back up your registry by selecting File > Export in the Registry Editor.

Press Win + R, type regedit, and press Enter.

Navigate to LSA Keys:

Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa.

Create or Modify Values:

Ensure the RunAsPPL DWORD is set to 1.

Ensure the RunAsPPLBoot DWORD is set to 1 if it exists; if not, create it and set the value.

Restart the PC.

In fact there have been other community members who have discussed this issue. If you've tried modifying the registry and the problem persists, then please don't worry, this is a display bug and cannot be taken as direct evidence that the feature is not enabled.

In this case, I encourage you to press Windows + F to open the Feedback Center and submit your feedback, the Windows development team regularly reviews submissions and pushes out updated patches. Please just be patient and watch for subsequent updates to be pushed out.

Feel free to reach out if you need further assistance or have additional questions.

Best Regards,

Martin | Microsoft Community Support Specialist

Was this answer helpful?

0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2024-12-16T11:11:01+00:00

    Thanks.. both my daughters PC and mine looked to working OK still today (after reboots).. but I checked the registry entries.
    Both our PCs had both the registry entries you detail, but both entries on both our PC's had the value set as "2".
    So I changed to 1, per your advice and on reboot, nothing seemed to change (i.e. they both still looks OK, i.e. set "on" correctly).
    Anyway - hope thats the end of it now and we have no more scares. MS should be extra careful on security issues so if it has display bugs or whatever, should be a priority to fix.

    Was this answer helpful?

    0 comments