LSA Subauthentication Registry Path Configuration

This article provides the exact Windows Registry path used to configure Local Security Authority (LSA) subauthentication packages, explains the specific values required to register custom subauthentication dynamic link libraries (DLLs), and outlines the steps necessary to manage these configurations safely within the Registry Editor.

The Registry Path for LSA Subauthentication

In Windows, Local Security Authority subauthentication packages for the standard MSV1_0 authentication package are managed under the following registry path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0

General LSA authentication and security packages are located directly within the parent key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

Configuring Subauthentication Packages

Subauthentication packages allow administrators and developers to provide custom validation rules (such as custom password filters, logon hours, or workstation restrictions) without replacing the entire MSV1_0 authentication package.

To register a subauthentication DLL under the MSV1_0 key:

  1. Open Registry Editor: Press Win + R, type regedit, and press Enter.
  2. Navigate to the Key: Browse to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0. If the MSV1_0 key does not exist under Lsa, create it as a new key.
  3. Add Subauthentication DLLs:
    • Create a new String Value (REG_SZ) named Auth0.
    • Set its value data to the file name of your custom subauthentication DLL (for example, CustomSubAuth.dll).
    • Additional subauthentication DLLs can be registered sequentially by creating subsequent string values named Auth1, Auth2, and so on.

Key Requirements and Behavior