LSA Protection Registry Key in Windows

This guide explains the exact Windows Registry location and configuration flags used to manage Local Security Authority (LSA) protection. Enabling LSA protection ensures that the LSA process runs as a Protected Process Light (PPL), preventing unauthorized processes and non-administrative attackers from reading its memory or extracting credentials.

The LSA Protection Registry Key Location

The configuration parameters for LSA protection are located within the Windows Registry Editor (regedit) under the following path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

Key Values and Flags

Inside the Lsa key, LSA protection is controlled primarily by a 32-bit DWORD value named RunAsPPL.

To configure LSA protection, set the RunAsPPL value using one of the following data values:

• 0: Disabled – LSA runs as a standard, non-protected process.
• 1: Enabled with UEFI Lock – LSA protection is enforced as a Protected Process Light (PPL) and is locked via a UEFI variable. It cannot be disabled solely by changing the registry; it requires physical access to the device to clear the UEFI variable.
• 2: Enabled without UEFI Lock – LSA runs as PPL, but the setting can be modified or disabled directly through the registry without interacting with UEFI firmware.

How to Enable LSA Protection via Regedit

1. Press Win + R, type regedit, and press Enter to launch the Registry Editor.
2. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa.
3. Look for the RunAsPPL DWORD (32-bit) value in the right pane. If it does not exist, right-click an empty area, select New > DWORD (32-bit) Value, and name it RunAsPPL.
4. Double-click RunAsPPL, set the Base to Hexadecimal, enter 1 (or 2), and click OK.
5. Restart the computer for the changes to take effect.

Verifying LSA Protection

After rebooting, you can verify that LSA is running in protected mode by opening the Windows Event Viewer. Navigate to Applications and Services Logs > Microsoft > Windows > Security-Mitigations > Kernel-Mode. Look for Event ID 12, which confirms that LSASS.exe started as a protected process.