Enable LSA Protection to Stop LSASS Memory Dumping

Local Security Authority (LSA) protection configures the Local Security Authority Subsystem Service (LSASS) process as a Protected Process Light (PPL). This security feature prevents unauthorized users and malware—such as Mimikatz—from reading or dumping LSASS process memory to steal credentials. This guide provides step-by-step instructions on enabling LSA protection across Windows systems using the Windows Registry Editor (regedit).

Step 1: Open the Registry Editor

  1. Press Windows Key + R to open the Run dialog box.
  2. Type regedit and press Enter.
  3. If prompted by User Account Control (UAC), click Yes to grant administrative privileges.

Step 2: Navigate to the LSA Registry Key

In the Registry Editor’s left-hand navigation pane or the top address bar, go to the following path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

Step 3: Create or Modify the RunAsPPL Value

  1. With the Lsa key selected, check the right pane for a value named RunAsPPL.
  2. If RunAsPPL does not exist:
    • Right-click an empty space in the right pane.
    • Select New > DWORD (32-bit) Value.
    • Name the new value RunAsPPL.
  3. Double-click RunAsPPL to edit its properties.
  4. Set the Value data field according to your preference:
    • 1: Enables LSA protection with UEFI variable validation (requires a reboot to take effect).
    • 2: Enables LSA protection without UEFI variable validation (Windows 11 22H2 and newer).
  5. Ensure the Base is set to Hexadecimal, then click OK.

Step 4: Restart the Computer

LSA protection is applied during the early boot sequence. You must restart the operating system for the changes to take effect:

  1. Save any open work.
  2. Restart your computer.

Step 5: Verify LSA Protection Is Active

To confirm that the LSASS process is running in protected mode:

  1. Press Windows Key + X and select Event Viewer.
  2. In the left pane, navigate to:
    Applications and Services Logs > Microsoft > Windows > CodeIntegrity > Operational (or System log).
  3. Look for Event ID 3065 or Event ID 3066:
    • Event ID 3065: Indicates that code integrity determined a process (LSASS) met the requirements for PPL.
    • Alternatively, check the System log for Event ID 12 from the source Wininit, which confirms: “LSASS.exe was started as a protected process with level: 4”.