This time, we will show you how to check whether "Local Security Authority (LSA) Protection" is enabled in Windows 11.
In Windows 11, there was an issue where the Windows Security warning "Local Security Authority protection is turned off" would appear, but Microsoft announced that it had resolved the issue on July 5, 2023.
Resolved? KB5007651 "Local Security Authority Protection is turned off."
However, the "Local Security Authority Protection" item is no longer displayed in Windows Security, and it is now impossible to tell whether it is enabled or disabled without checking the Event Viewer. (It is displayed in the latest version.)
What is Local Security Authority Protection (LSASS)?
Helps protect user credentials by preventing unsigned drivers and plug-ins from being loaded by the Local Security Authority.
The Local Security Authority Protection (LSASS) in Windows 11 is a service that plays an important role in keeping your computer secure.
LSASS is responsible for a variety of functions, including authenticating users, managing passwords, and enforcing security policies.
If LSASS is turned off, your computer may be less secure and more vulnerable to attacks.
We recommend enabling this for both individuals and businesses.
"LSASS" stands for "Local Security Authority Subsystem Service."
* "Local Security Authority Protection" isメモリ整合性can be enabled even if it is set to "Off".
How to check if "Local Security Authority Protection" is enabled
1. At the bottom of the screenStart buttonRight-click and click Event Viewer.
2. The Event Viewer will open. Click Event Viewer (Local) > Windows Logs > System.
After a few moments, information will appear on the right.
3. Right-click "System" > "Filter Current Log".
4. Under "Event Resources", check "Wininit".
5. Click OK.
6. Click on Event ID "12" and if it says "LSASS.exe was launched as a level 4 protected process" in the General tab below, then "Local Security Authority Protection" is enabled.
Points to note
The Event Viewer also stores previous information.
Be sure to check the date and time to see if Local Security Authority Protection is currently enabled.
Microsoft announced on July 5, 2023 that they have fixed the issue where the "Local Security Authority Protection" warning was displayed, but the "Local Security Authority Protection" item is no longer displayed (although it is still displayed in the latest version).
this is,It does not mean that "Local Security Authority Protection" is enabled..
Please pay attention here.
To check whether "Local Security Authority Protection" is currently enabled, restart your PC and check for Event ID "12" after the PC is started.
I actually checked it on my own Windows 11 (three environments).
Then,Win11 Solution! The Cause of the "Local Security Authority Protection is Turned Off" ErrorWhen I restarted the computer after deleting the registry value I added, the event ID "12" did not appear.
If "Wininit" event ID "12" is not displayed, it means that "Local Security Authority Protection" is not enabled.It will be.
After adding the registry value again and restarting the computer, event ID "12" was displayed.
If you previously had the "Local Security Authority Protection" option set to "On," it may be enabled, but we recommend that you always check, especially on corporate PCs.
update information
2023/07/12:
I checked on the newly installed Windows 11, and sure enough, the "Wininit" event ID "12" is not displayed.
To enable "Local Security Authority Protection," you need to add a registry value, which Microsoft has also published as a workaround, as described on the following page.
Win11 Solution! The Cause of the "Local Security Authority Protection is Turned Off" Error
this is,Local Security Authority Protection is not enabled by defaultThat's what it means.
2024/10/10:
* In Windows 11 version 24H2, if you reboot after installing the update KB5044285 released on 2024/10/08,Task tray (notification area)There was an exclamation mark on the Windows Security icon.
I opened Windows Security and checked the "Local Security Authority Protection" item, and it was set to "On" and said that a restart was required. After restarting, the exclamation marks disappeared, and I could also confirm in the Event Viewer that "Local Security Authority Protection" was enabled.
Comment: