LSA Subauthentication Packages Registry Key

This article outlines the specific Windows Registry path used to configure Local Security Authority (LSA) subauthentication packages. It explains the exact registry key, the values required to register custom authentication DLLs, how the MSV1_0 authentication package processes these submodules, and essential considerations for implementation.

The Subauthentication Packages Registry Key

In the Windows Registry (regedit.exe), the configuration parameters for LSA subauthentication packages are stored in the following registry path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0

The MSV1_0 authentication package handles local and network logons via NTLM. Subauthentication packages are custom dynamic-link libraries (DLLs) that extend or override the default validation rules used by MSV1_0.

Registry Value Configuration

To register and configure subauthentication packages under the MSV1_0 key, specific registry values must be created or modified:

• Value Name: Auth0, Auth1, Auth2, up to Auth255 (numbered sequentially based on priority and slot)
• Type: REG_SZ (String)
• Value Data: The file name of the subauthentication DLL (for example, customsubauth.dll)

When the LSA initializes, MSV1_0 reads the MSV1_0 key and loads the listed DLLs in the order specified by the numerical suffix of the Auth entries.

Function and Execution

Subauthentication packages allow administrators and developers to implement custom logon validation logic without replacing the primary MSV1_0 authentication package. Common use cases include:

• Enforcing custom password complexity or expiration policies.
• Adding workstation or time-based logon restrictions beyond standard Active Directory controls.
• Integrating custom authentication algorithms for specific logon requests.

Deployment Requirements

1. File Location: The subauthentication DLL must be placed in the %SystemRoot%\System32 directory.
2. Domain Controllers: If domain logons are being validated, the package must be installed and registered on every Domain Controller in the domain.
3. Restart: Changes to the LSA registry keys generally require a system restart to take effect, as authentication packages load during the early boot process.