LSA Subauthentication Registry Path Configuration
This article provides the exact Windows Registry path used to configure Local Security Authority (LSA) subauthentication packages, explains the specific values required to register custom subauthentication dynamic link libraries (DLLs), and outlines the steps necessary to manage these configurations safely within the Registry Editor.
The Registry Path for LSA Subauthentication
In Windows, Local Security Authority subauthentication packages for the standard MSV1_0 authentication package are managed under the following registry path:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
General LSA authentication and security packages are located directly within the parent key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
Configuring Subauthentication Packages
Subauthentication packages allow administrators and developers to provide custom validation rules (such as custom password filters, logon hours, or workstation restrictions) without replacing the entire MSV1_0 authentication package.
To register a subauthentication DLL under the MSV1_0
key:
- Open Registry Editor: Press
Win + R, typeregedit, and press Enter. - Navigate to the Key: Browse to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0. If theMSV1_0key does not exist underLsa, create it as a new key. - Add Subauthentication DLLs:
- Create a new String Value (
REG_SZ) namedAuth0. - Set its value data to the file name of your custom subauthentication
DLL (for example,
CustomSubAuth.dll). - Additional subauthentication DLLs can be registered sequentially by
creating subsequent string values named
Auth1,Auth2, and so on.
- Create a new String Value (
Key Requirements and Behavior
- File Location: The specified DLLs must reside in
the
%SystemRoot%\System32directory. - Export Function: Custom subauthentication DLLs must
export the standard
Msv1_0SubAuthenticationRoutineorMsv1_0SubAuthenticationFilterfunctions to be properly recognized and executed by LSA. - System Restart: Changes made to LSA authentication and subauthentication registry values require a system reboot to take effect.