LSA Protection Registry Key and Settings

Local Security Authority (LSA) protection, also known as LSA RunAsPPL (Protected Process Light), is a Windows security feature that prevents unauthorized processes from inspecting or tampering with the memory of the lsass.exe process. This article details the exact Windows Registry path used to store LSA protection settings, outlines the configuration values for enabling or disabling the feature, and provides instructions on how to apply these settings using the Registry Editor.

The LSA Protection Registry Location

The configuration settings for Local Security Authority protection are stored under the following Registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

Within this key, LSA protection is controlled primarily by a 32-bit DWORD value named RunAsPPL. On newer builds of Windows 11, an additional companion value named RunAsPPLBoot may also be used to enforce protection during the boot sequence.

Registry Value Configuration Details

To configure the RunAsPPL DWORD value, assign one of the following numeric data values:

• 0 (Disabled): LSA runs as a standard process without PPL protection.
• 1 (Enabled with UEFI Variable): LSA runs as a protected process. This configuration writes a UEFI variable to firmware, preventing the feature from being disabled solely by modifying the registry.
• 2 (Enabled without UEFI Variable): LSA runs as a protected process without locking the configuration to UEFI firmware. This allows the setting to be toggled on or off directly via the registry upon the next reboot.

How to Configure LSA Protection via Regedit

1. Press Win + R, type regedit, and press Enter to open the Registry Editor.
2. Navigate to the following path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
3. In the right pane, locate the RunAsPPL value. If it does not exist:
   • Right-click an empty area, select New > DWORD (32-bit) Value.
   • Name the value RunAsPPL.
4. Double-click RunAsPPL, set the Base to Hexadecimal, and enter 1 (or 2 depending on your requirements).
5. (Optional for Windows 11): Create or set the DWORD value RunAsPPLBoot to 2 to ensure consistent enablement across reboots.
6. Click OK and restart the computer for the changes to take effect.

Verifying LSA Protection Status

After restarting the machine, verify that LSA protection is active by checking the Windows Event Viewer:

1. Open Event Viewer (eventvwr.msc).
2. Navigate to Applications and Services Logs > Microsoft > Windows > LSA > Operational.
3. Look for Event ID 3065 or Event ID 3066:
   • Event ID 3065: Indicates that LSA was started as a protected process.
   • Event ID 3066: Indicates that LSA is configured to run as a protected process, but not fully enforced (audit mode).