Regedit Key for LSA Protection Configuration

Local Security Authority (LSA) protection is a critical Windows security feature that prevents unauthorized processes from injecting code or reading memory from the lsass.exe process, effectively mitigating credential-theft techniques such as Pass-the-Hash and Mimikatz-based memory dumping. This article identifies the exact Windows Registry key used to configure LSA protection (RunAsPPL), outlines the relevant values, and explains how to configure and verify the setting directly via Regedit.

The LSA Registry Path

The configuration parameters for Local Security Authority protection are stored under the following Registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

Key Values and Configuration

Within the Lsa key, LSA protection is controlled primarily by a 32-bit DWORD value named RunAsPPL.

To manually configure LSA Protection via the Registry Editor:

1. Press Win + R, type regedit, and press Enter.
2. Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
3. Locate or create a DWORD (32-bit) Value named RunAsPPL.
4. Set the value data to one of the following:

• 0: Disabled. LSA runs as a standard protected process (default in older Windows versions).
• 1: Enabled with UEFI variable. LSA runs as a Protected Process Light (PPL). This setting sets a UEFI variable in firmware, meaning it cannot be disabled remotely via the registry alone; physical access to UEFI firmware is required to revert.
• 2: Enabled without UEFI variable. LSA runs as PPL, but the setting can be toggled on or off directly through software and Registry updates without firmware interaction.

(Note: On Windows 11 22H2 and later, an additional value named RunAsPPLBoot may also appear, with 2 representing enablement without UEFI locking).

Applying and Verifying the Changes

After modifying the RunAsPPL value, restart the computer for the changes to take effect.

To verify that LSA Protection is active after rebooting:

1. Open Event Viewer (eventvwr.msc).
2. Navigate to Applications and Services Logs > Microsoft > Windows > LSA > Operational.
3. Look for Event ID 3033, which confirms: “The process lsass.exe was started as a protected process (light) with level: 4”.