LSA Credential Vault Encryption Registry Key

This article explains the Windows Registry keys that hold configuration parameters and underlying data for the Local Security Authority (LSA) and Credential Vault encryption. It outlines the specific paths within regedit, the roles these keys play in credential security, and how Windows manages LSA protection parameters.

Primary LSA Configuration Key

The primary configuration parameters for the Local Security Authority and its credential isolation mechanisms are located at:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

This registry key controls how the LSA subsystem handles authentication packages, security providers, and process memory protection. Important parameters inside this key include:

• RunAsPPL: Configures LSA as a Protected Process Light (PPL), preventing non-protected processes from reading LSA memory or tampering with encrypted credentials.
• LsaCfgFlags: Configures Windows Defender Credential Guard, which uses virtualization-based security to isolate secrets.
• Security Packages: Lists the security support providers (SSPs) loaded into the LSA process.

Credential Vault Configuration Key

The system-level configuration and policy settings for the Windows Vault—which manages web credentials, Windows credentials, and certificate storage—are managed under:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Vault

and the software-level vault definitions located at:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Vault

These keys govern how credential vaults are registered, initialized, and integrated with the Data Protection API (DPAPI) and the LSA.

Encrypted Secrets Storage Location

While the configuration parameters reside in the SYSTEM hive, the actual encrypted LSA secrets (including service account passwords, cached domain credentials, and internal encryption keys) are stored at:

HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets

Access to this key is restricted to the NT AUTHORITY\SYSTEM account by default. These entries are encrypted using a system-generated master key derived from the system boot key (Syskey/DPAPI) and managed directly by the LSA subsystem.