Fix: ‘Local Security Authority Protection Is Off’ issue

Many people want to know how to Fix ‘Local Security Authority Protection Is Off’ issue. The Local Security Authority protection on your Windows 11 PC is an important process that keeps your credentials safe. The idea behind LSA is to make sure that there are no security holes that could let a third party steal your personal information. It is a process that verifies that your credentials are real before letting you into the system.

Even though the process has been shown to work, sometimes a user will find that the feature has been turned off. It is sometimes turned off by hand because the process is so heavy. Other times, it is turned off automatically after Windows or system updates. Turning on LSA that was turned off by hand is easy if you know how. On the other hand, if the system closes the process every time an update is made, you may need to take serious steps to Fix ‘Local Security Authority Protection Is Off’ issue.

What is Local Security Authority Protection (LSA Protection)?

The Local Security Authority (LSA) is a feature of Microsoft’s Windows operating system that is in charge of managing and allowing interactive log-ins to the computer, among other things. This feature was first added to Windows 8.1. Since then, it has been added to all subsequent versions of Windows and is turned on by default.

LSA is also in charge of managing and enforcing the computer’s local security policies, such as the number of times you can try to log in, how long you can be locked out for, etc. It also takes care of the audit policies and records what happened. With this, one of the most important things the Local Security Authority has to do is make access tokens and give them out.

In simpler terms, LSA protection protects the system by only letting authorized users in. It also stops credential theft by preventing unauthorized code injection into the “LSASS.exe” process, which is what runs the Local Security Authority protection feature in the Windows OS.

What are the causes of Local Security Authority Protection being off?

1. Operating System Not Supported: LSA Protection might not be available or turned on in older versions of Windows that are not supported. Some versions or editions of Windows may not have this security feature at all.
2. Group Policy Configuration: Administrators or users might turn off LSA Protection on purpose by making changes to Group Policy settings or the Registry. This could be done to fix certain problems or to make the feature work with certain programs that might not work well with it.
3. Conflicts with Third-Party Software: Some third-party software or security solutions can cause LSA Protection to stop working. This can happen because of problems with compatibility or wrong settings.
4. Malware or Security Breach: Malicious software or unauthorized access to the system could change security settings, including LSA Protection, as part of an attack to gain higher privileges or get around security mechanisms.
5. System Misconfiguration: A mistake in the system settings or a mistake made by a person while managing the system could turn off LSA Protection by accident.

Fix: ‘Local Security Authority Protection Is Off’ issue

Enable Local Security Authority Protection using Registry

1. Type regedit into the search box in Windows and hit Enter.
2. Click Yes when User Account Control comes up.
3. Click on File > Export.
4. Under Export Range, choose All, and then save the backup where you want.
5. Next, go to the place below:
   Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
6. Find RunAsPPL on the right side of the window and double-click it.
7. Put 1 in the box and click OK.
8. Last, you need to restart your system.

Perform Some Preliminary Checks

1. Close all of the apps that are open on your device. Then, turn your device back on.
2. Try to turn on the feature on your own in the Core isolation settings. To do this, open the Windows Security app, go to the Device Security tab, and turn on the switch under Local Security Authority Protection.
3. If the feature is already turned on in the security settings, but the warning message keeps showing up, turn it off once, turn it back on, and then restart your device.
4. Turn off the third-party security software you use temporarily to make sure that it doesn’t interfere with the feature and turn it off.

Use Group Policy

1. Type Group policy into the search box in Windows and press Enter.
2. Visit the following place:
   System > Local Security Authority > Local Computer Policy > Computer Configuration > Administrative Templates > System
3. Right-click the Configure LSASS to run as a protected process item on the right side of the window and choose Edit.
4. Go with Enabled.
5. Select Enabled with UEFI Lock under Options, then click Apply and OK.
6. Turn your computer back on.

Check for corrupted files

1. Type cmd into the Windows search box.
2. Right-click on the result for “Command Prompt” and choose “Run as administrator.”
3. User Account Control will ask if you want to let changes happen. Click “Yes” if you do.
4. Copy and paste the command below into the new window:
   • /SCANNOW sfc
5. Press Enter, and then wait until the scan is done.
6. When you’re done, press Enter after each of these commands to run them:
   • DISM /Online /Cleanup-Image /ScanHealth
   • DISM /Online /Cleanup-Image /CheckHealth
   • DISM /Online /Clean-Image /RestoreHealth
7. Restart your PC.

Use PowerShell

1. Type PowerShell into the Windows search box.
2. Right-click on the result and choose “Run as administrator.”
3. Click Yes when UAC comes up.
4. Copy and paste the commands below, then press Enter after each one:
   a. reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL /t REG_DWORD /d 2 /f
   b. reg add HKLMSYSTEMCurrentControlSetControlLsa /v RunAsPPLBoot /t REG_DWORD /d 2 /f /f
5. After these two things are done, close PowerShell and restart your system.

Ensure the Warning Isn’t Just a False Flag

1. Search for “Event Viewer” in Windows Search to open the Event Viewer app.
2. Go to Applications and Services Logs > Microsoft > Windows > LSA on the sidebar on the left.
3. Find the LSA protection event with ID 5004 and make sure it is turned on and working.

The Importance of Fixing the ‘Local Security Authority Protection Is Off’ Issue

“Local Security Authority Protection Is Off” is a major security issue that needs to be fixed as soon as possible. Here are the most important reasons why this problem needs to be fixed:

1. Security Vulnerability: When the “Local Security Authority Protection” is turned off, it leaves the system open to security breaches and unauthorized access. This could lead to sensitive data being leaked, unauthorized users taking control of the system, and malware or ransomware attacks.
2. System Integrity: Turning on ‘Local Security Authority Protection’ helps keep the system’s integrity by protecting important system processes and services. It stops unauthorized changes and makes sure that important parts aren’t messed with.
3. Protection from Advanced Threats: Turning on “Local Security Authority Protection” adds an extra layer of protection against advanced threats and exploits. It can stop different kinds of attacks that try to take over system-level processes.
4. Compliance Requirements: Certain industries or organizations must use certain security measures to meet compliance standards. Putting this protection on can help meet these needs and make sure that industry standards are followed.

Questions and Answers