Privacy and Security Enable or Disable Local Security Authority (LSA) Protection in Windows 11


  • Staff
Windows_Security_banner.png

This tutorial will show you how to enable or disable Local Security Authority (LSA) protection for all users in Windows 11.

Core isolation is a security feature of Microsoft Windows that protects important core processes of Windows from malicious software by isolating them in memory. It does this by running those core processes in a virtualized environment.

Windows 11, version 22H2 supports additional protection for the Local Security Authority (LSA) process to prevent code injection that could compromise credentials.

Windows has several critical processes to verify a user’s identity. The LSA is one of those processes, responsible for authenticating users and verifying Windows logins. It is responsible for handling user credentials, like passwords, and tokens used to provide single sign-on to Microsoft accounts and Azure services. Attackers have developed tools and have abused Microsoft tools to take advantage of this process to steal credentials. To combat this, additional LSA protection will be enabled by default in the future for new, enterprise-joined Windows 11 devices making it significantly more difficult for attackers to steal credentials by ensuring LSA loads only trusted, signed code.

Reference:
learn.microsoft.com

What's new in Windows 11, version 22H2 for IT pros - What's new in Windows

Learn more about what's new in Windows 11 version 21H2, including servicing updates, Windows Subsystem for Linux, the latest CSPs, and more.
learn.microsoft.com
learn.microsoft.com

Configure added LSA protection

Learn how to configure added protection for the Local Security Authority (LSA) process to prevent code injection that could compromise credentials.
learn.microsoft.com
www.microsoft.com

New security features for Windows 11 will help protect hybrid work | Microsoft Security Blog

Attackers haven’t wasted any time capitalizing on the rapid move to hybrid work. Every day cyber criminals and nation states alike have improved their targeting, speed and accuracy as the world adapted to working outside the office.
www.microsoft.com www.microsoft.com

You must be signed in as an administrator to enable or disable Local Security Authority (LSA) protection.

LSA requires CPU virtualization turned on.


www.elevenforum.com

Known and Resolved issues for Windows 11 version 22H2

Windows message center: https://www.elevenforum.com/t/optional-non-security-preview-updates-for-windows-11-22h2-now-ends-june-26-2024.22977/ Current status as of September 26, 2023 Microsoft is delivering a new wave of continuous innovation to eligible Windows 11, version 22H2 devices with new...
www.elevenforum.com www.elevenforum.com

Resolved

After installing "Update for Microsoft Defender Antivirus antimalware platform - KB5007651 (Version 1.0.2302.21002)", you might receive a security notification or warning stating that "Local Security protection is off. Your device may be vulnerable." and once protections are enabled, your Windows device might persistently prompt that a restart is required. Important: This issue affects only "Update for Microsoft Defender Antivirus antimalware platform - KB5007651 (Version 1.0.2302.21002)". All other Windows updates released on March 14, 2023 for affected platforms (KB5023706 and KB5023698), do not cause this issue.

Workaround: If you have enabled Local Security Authority (LSA) protection and have restarted your device at least once, you can dismiss warning notifications and ignore any additional notifications prompting for a restart. You can verify that LSA protection is enabled by looking in Event Viewer using the information available here. Important: Currently, Microsoft does not recommend any other workaround for this issue.

Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

Updated July 05, 2023: This issue was resolved in an update for Windows Security platform antimalware platform KB5007651 (Version 1.0.2306.10002). If you would like to install the update before it is installed automatically, you will need to check for updates.

If still needed, you can use Option Two, Option Three, or Option Five below to enable LSA without the warning.



Contents

  • Option One: Turn On or Off Local Security Authority (LSA) Protection in Windows Security
  • Option Two: Turn On or Off Local Security Authority (LSA) Protection using REG file
  • Option Three: Turn On or Off Local Security Authority (LSA) Protection using Command
  • Option Four: Enable or Disable Local Security Authority (LSA) Protection in Local Group Policy Editor
  • Option Five: Enable or Disable Local Security Authority (LSA) Protection using REG file




Option One

Turn On or Off Local Security Authority (LSA) Protection in Windows Security


1 Open Windows Security.

2 Click/tap on Device security on the left side, and click/tap on the Core isolation details link on the right side. (see screenshot below)

LSA_protection_Windows_Security-1.png

3 Turn on (default) or off Local Security Authority protection for what you want. (see screenshots below)

LSA_protection_Windows_Security-2.png
LSA_protection_Windows_Security-3.png

4 If prompted by UAC, click/tap on Yes to approve.

5 Restart the computer to apply. (see screenshot below)

6 If prompted by UAC, click/tap on Yes to approve.

LSA_protection_Windows_Security-5.png




Option Two

Turn On or Off Local Security Authority (LSA) Protection using REG file


1 Do step 2 (on without UEFI Lock), step 3 (on with UEFI Lock) or step 4 (off) below for what you want.

2 Turn On Local Security Authority (LSA) Protection without UEFI Lock

This is the default setting.


A) Click/tap on the Download button below to download the REG file below, and go to step 5 below.​

Turn_ON_Local_Security_Authority_protection_without_UEFI_Lock.reg​


(Contents of REG file for reference)
Code: 
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"RunAsPPL"=dword:00000002
"RunAsPPLBoot"=dword:00000002

3 Turn On Local Security Authority (LSA) Protection with UEFI Lock

When LSA is used with UEFI lock and Secure Boot, additional protection is achieved because disabling the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa registry key has no effect. It acts as a tamper protection.


A) Click/tap on the Download button below to download the REG file below, and go to step 5 below.​

Turn_ON_Local_Security_Authority_protection_with_UEFI_Lock.reg​


(Contents of REG file for reference)
Code: 
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"RunAsPPL"=dword:00000001
"RunAsPPLBoot"=dword:00000002

4 Turn Off Local Security Authority (LSA) Protection

If you turned on LSA with UEFI Lock using step 3, then you will need to use the Local Security Authority Protected Process Opt-out tool to remove the UEFI variable in the registry.


A) Click/tap on the Download button below to download the REG file below, and go to step 5 below.​

Turn_OFF_Local_Security_Authority_protection.reg​


(Contents of REG file for reference)
Code: 
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"RunAsPPL"=dword:00000000
"RunAsPPLBoot"=dword:00000000

5 Save the .reg file to your desktop.

6 Double click/tap on the downloaded .reg file to merge it.

7 When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.

8 Restart the computer to apply.

9 You can now delete the downloaded .reg file if you like.




Option Three

Turn On or Off Local Security Authority (LSA) Protection using Command


1 Open Windows Terminal (Admin), and select Command Prompt.

2 Copy and paste the command below you want to use into Windows Terminal (Admin), and press Enter.

Turn On Local Security Authority (LSA) Protection without UEFI Lock​

This is the default setting.


reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL /t REG_DWORD /d 2 /f & reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPLBoot /t REG_DWORD /d 2 /f​

OR​

Turn On Local Security Authority (LSA) Protection with UEFI Lock​

When LSA is used with UEFI lock and Secure Boot, additional protection is achieved because disabling the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa registry key has no effect. It acts as a tamper protection.


reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL /t REG_DWORD /d 1 /f & reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPLBoot /t REG_DWORD /d 2 /f​

OR​

Turn Off Local Security Authority (LSA) Protection​

If you turned on LSA with UEFI Lock, then you will need to use the Local Security Authority Protected Process Opt-out tool to remove the UEFI variable in the registry.


reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL /t REG_DWORD /d 0 /f & reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPLBoot /t REG_DWORD /d 0 /f​

3 Restart the computer to apply.




Option Four

Enable or Disable Local Security Authority (LSA) Protection in Local Group Policy Editor


The Local Group Policy Editor is only available in the Windows 11 Pro, Enterprise, and Education editions.

All editions can use Option Fve to configure the same policy.


1 Open the Local Group Policy Editor (gpedit.msc).

2 Navigate to the policy location below in the left pane of the Local Group Policy Editor. (see screenshot below)

Computer Configuration > Administrative Templates > System > Local Security Authority​

LSA_protection_gpedit-1.png

3 In the right pane of Local Security Authority in the Local Group Policy Editor, double click/tap on the Configure LSASS to run as a protected process policy to edit it. (see screenshot above)

4 Do step 5 (default), step 6 (disable), step 7 (enable with UEFI Lock), or step 8 (enable without UEFI Lock) below for what you want.

5 Default User Choice Local Security Authority (LSA) Protection

This is the default setting to allow using Option One Option Two, and Option Three.


A) Select (dot) Not Configured. (see screenshot below)​

B) Click/tap on OK, and go to step 9 below.​

LSA_protection_gpedit-2.png

6 Disable Local Security Authority (LSA) Protection

This will override and prevent using Option One, Option Two, and Option Three.


A) Select (dot) Enabled. (see screenshot below)​

B) Select Disabled in the Configure LSA to run as a protected process drop menu.​

C) Click/tap on OK, and go to step 9 below.​

LSA_protection_gpedit-3.png

7 Enable Local Security Authority (LSA) Protection with UEFI Lock

This will override and prevent using Option One, Option Two, and Option Three.

When LSA is used with UEFI lock and Secure Boot, additional protection is achieved because disabling the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa registry key has no effect. It acts as a tamper protection.


A) Select (dot) Enabled. (see screenshot below)​

B) Select Enabled with UEFI Lock in the Configure LSA to run as a protected process drop menu.​

C) Click/tap on OK, and go to step 9 below.​

LSA_protection_gpedit-4.png

8 Enable Local Security Authority (LSA) Protection without UEFI Lock

This will override and prevent using Option One, Option Two, and Option Three.


A) Select (dot) Enabled. (see screenshot below)​

B) Select Enabled without UEFI Lock in the Configure LSA to run as a protected process drop menu.​

C) Click/tap on OK, and go to step 9 below.​

LSA_protection_gpedit-4.png

9 You can now close the Local Group Policy Editor if you like.




Option Five

Enable or Disable Local Security Authority (LSA) Protection using REG file


1 Do step 2 (default), step 3 (disable), step 4 (enable with UEFI Lock), or step 5 (enable without UEFI Lock) below for what you want.


 2. Default User Choice Local Security Authority (LSA) Protection

This is the default setting to allow using Option One, Option Two, and Option Three.


A) Click/tap on the Download button below to download the file below, and go to step 6 below.​

Default_user_choice_Local_Security_Authority_protection.reg​


(Contents of REG file for reference)
Code: 
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System]
"RunAsPPL"=-


 3. Disable Local Security Authority (LSA) Protection

This will override and prevent using Option One, Option Two, and Option Three.


A) Click/tap on the Download button below to download the file below, and go to step 6 below.​

Disable_Local_Security_Authority_protection.reg​


(Contents of REG file for reference)
Code: 
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System]
"RunAsPPL"=dword:00000000


 4. Enable Local Security Authority (LSA) Protection with UEFI Lock

This will override and prevent using Option One, Option Two, and Option Three.

When LSA is used with UEFI lock and Secure Boot, additional protection is achieved because disabling the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa registry key has no effect.


A) Click/tap on the Download button below to download the file below, and go to step 6 below.​

Always_Enable_Local_Security_Authority_protection_with_UEFI_Lock.reg​


(Contents of REG file for reference)
Code: 
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System]
"RunAsPPL"=dword:00000001


 5. Enable Local Security Authority (LSA) Protection without UEFI Lock

This will override and prevent using Option One, Option Two, and Option Three.


A) Click/tap on the Download button below to download the file below, and go to step 6 below.​

Always_Enable_Local_Security_Authority_protection_without_UEFI_Lock.reg​


(Contents of REG file for reference)
Code: 
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System]
"RunAsPPL"=dword:00000002

6 Save the REG file to your desktop.

7 Double click/tap on the downloaded REG file to merge it.

8 When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.

9 You can now delete the downloaded REG file if you like.


That's it,
Shawn Brink


Related Tutorials

 

Attachments

  • Windows_Security.png
    Windows_Security.png
    6 KB · Views: 99
  • Turn_OFF_Local_Security_Authority_protection.reg
    684 bytes · Views: 227
  • Always_Enable_Local_Security_Authority_protection_with_UEFI_Lock.reg
    634 bytes · Views: 262
  • Always_Enable_Local_Security_Authority_protection_without_UEFI_Lock.reg
    638 bytes · Views: 257
  • Disable_Local_Security_Authority_protection.reg
    634 bytes · Views: 274
  • Default_user_choice_Local_Security_Authority_protection.reg
    608 bytes · Views: 257
  • Turn_ON_Local_Security_Authority_protection_with_UEFI_Lock.reg
    672 bytes · Views: 95
  • Turn_ON_Local_Security_Authority_protection_without_UEFI_Lock.reg
    672 bytes · Views: 139
Last edited:
Click to expand...

My Computer

System One

  • OS
    Windows 11 23H2
    Computer type
    Laptop
    Manufacturer/Model
    Dell XPS 13 9360
    CPU
    Intel(R) Core(TM) i7-7500U CPU @ 2.70GHz
    Memory
    8 GB
Brink said:
I still have the LSA setting in Windows Security on build 25357 (Canary).
Click to expand...
I have the LSA toggle back on all builds including R.P. 22621.1635, but not on Public Build 22621.1635.
Yet the registry settings are the same and both show the same updates with KB5007651.
I cannot explain why the toggle is missing on Public Build. 😎🤷‍♂️

1683242705846.png


1683242609943.png


1683242847113.png


Public Build 22621.1635, no LSA toggle. 🤷‍♂️😎

1683243094004.png


1683243188371.png
 

My Computer

System One

  • OS
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    Lenovo Yoga 920
    CPU
    Intel I7-8550U
    Motherboard
    n/a
    Memory
    16GB
    Graphics Card(s)
    Intel Graphics UHD 620
    Sound Card
    Realtek High Definition Audio (SST)
    Monitor(s) Displays
    4k Touch screen
    Screen Resolution
    3480 x 2160
    Hard Drives
    512GB NVMe
Brink said:
I still have the LSA setting in Windows Security on build 25357 (Canary).
Click to expand...
Hi Brink,

Looks like the LSA toggle is only present on Insider Builds even if they have the same Windows Security Service Version 1.2303.28002-0.
I cannot find where the difference is that hides the LSA Toggle. 😎🤷‍♂️
The R.P. 22621.1635 looks the same as Public Build 22621.1635, yet the R.P. has the LSA toggle, while the public build does not.
Would be nice to know what is causing the different behavior.
I check 3 machines with Public Build 22621.1635 and they all have this Security Service Version, but none shows the LSA Toggle.
While insider Builds R.P., Beta and Dev have the LSA Toggle with the same Windows Security Service Version. 😵‍💫🤷‍♂️
Perhaps they removed the toggle switch because the LSA is controlled with the Registry settings and/or the Group Policy so the toggle switch becomes useless, even when it is present it is not working properly unless the registry settings match the toggle switch. 🤣🤣🤣😵‍💫
Typical MS confusing mess. 🤷‍♂️


1683246372734.png
 
Last edited:

My Computer

System One

  • OS
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    Lenovo Yoga 920
    CPU
    Intel I7-8550U
    Motherboard
    n/a
    Memory
    16GB
    Graphics Card(s)
    Intel Graphics UHD 620
    Sound Card
    Realtek High Definition Audio (SST)
    Monitor(s) Displays
    4k Touch screen
    Screen Resolution
    3480 x 2160
    Hard Drives
    512GB NVMe
I have the 1.0.2303.28002-0 In my windows-<system32->Security health - how to I get that loaded into Defender ?
 

My Computer

System One

  • OS
    Windows 11 Intel i5 10400 HD630 graphics chip
    Computer type
    PC/Desktop
    Manufacturer/Model
    HP
    CPU
    i5-10400
    Memory
    12 gb
    Graphics Card(s)
    HD630 chipset
    Monitor(s) Displays
    LG 24inch
    Hard Drives
    SSD, external usb drive 1tb for files/backups
    Keyboard
    wireless Logi
    Mouse
    ms 4000 wireless mouse
    Internet Speed
    10meg
    Browser
    Firefox
    Antivirus
    Defender
    Other Info
    Win11 Home 23H2 22631.3527 04/23/24
TheVisitor said:
I have the 1.0.2303.28002-0 In my windows-<system32->Security health - how to I get that loaded into Defender ?
Click to expand...
You should also have the SecurityHealthSetup.exe in the same folder. That is the one that installs it.


1683248601087.png



1683248761786.png
 

My Computer

System One

  • OS
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    Lenovo Yoga 920
    CPU
    Intel I7-8550U
    Motherboard
    n/a
    Memory
    16GB
    Graphics Card(s)
    Intel Graphics UHD 620
    Sound Card
    Realtek High Definition Audio (SST)
    Monitor(s) Displays
    4k Touch screen
    Screen Resolution
    3480 x 2160
    Hard Drives
    512GB NVMe
Brink said:
I still have the LSA setting in Windows Security on build 25357 (Canary).
Click to expand...
Hi Brink,
For anybody interested in nonsense. I figured out how they hide the LSA toggle switch.
I compared the feature configurations between Public Build 22621.1635 and R.P. 22621.1635 and I found the experimental one that is hiding the LSA toggle switch. It is called EnablePPLForConsumers.
In the public builds they just disabled it as you can see below.
If I Enable the feature ID or I just reset to a no show the toggle switch pops up again after a reboot also in the public builds.
Typical MS confusion without any warning.
I hate inconsistent behavior like this one created by MS. (Maybe another A.I. experimental B.S. 🤣🤣)
Drives me nuts. 😵‍💫🤷‍♂️


[40025975] (EnablePplForConsumers)
Priority : Service (4)
State : Disabled (1)
Type : Experiment (1)
 

My Computer

System One

  • OS
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    Lenovo Yoga 920
    CPU
    Intel I7-8550U
    Motherboard
    n/a
    Memory
    16GB
    Graphics Card(s)
    Intel Graphics UHD 620
    Sound Card
    Realtek High Definition Audio (SST)
    Monitor(s) Displays
    4k Touch screen
    Screen Resolution
    3480 x 2160
    Hard Drives
    512GB NVMe

Attachments

  • Screenshot 2023-05-05 053804.png
    Screenshot 2023-05-05 053804.png
    5.7 KB · Views: 41

My Computer

System One

  • OS
    Windows 11 Intel i5 10400 HD630 graphics chip
    Computer type
    PC/Desktop
    Manufacturer/Model
    HP
    CPU
    i5-10400
    Memory
    12 gb
    Graphics Card(s)
    HD630 chipset
    Monitor(s) Displays
    LG 24inch
    Hard Drives
    SSD, external usb drive 1tb for files/backups
    Keyboard
    wireless Logi
    Mouse
    ms 4000 wireless mouse
    Internet Speed
    10meg
    Browser
    Firefox
    Antivirus
    Defender
    Other Info
    Win11 Home 23H2 22631.3527 04/23/24
Should all the toggles be On yet it still says that you have to reboot your device, even though you've rebooted it numerous times, the second option worked for me (via registry editor).
 

My Computer

System One

  • OS
    Windows 11 Pro (Beta Build 22635.3566)
    Computer type
    PC/Desktop
    Manufacturer/Model
    Alienware
asturias7 said:
Should all the toggles be On yet it still says that you have to reboot your device, even though you've rebooted it numerous times, the second option worked for me (via registry editor).
Click to expand...

Yes, these 2 registry DWORDs RunAsPPL and RunAsPPLBoot, should be set with a value of 2.
Some users reported RunAsPPLBoot missing, in some cases both entries were missing.
If they are both set as shown here and LSA toggle switch is on, everything should be fine.
I have not seen any official MS fix for these issues yet. 🤷‍♂️
1683944441870.png
 

My Computer

System One

  • OS
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    Lenovo Yoga 920
    CPU
    Intel I7-8550U
    Motherboard
    n/a
    Memory
    16GB
    Graphics Card(s)
    Intel Graphics UHD 620
    Sound Card
    Realtek High Definition Audio (SST)
    Monitor(s) Displays
    4k Touch screen
    Screen Resolution
    3480 x 2160
    Hard Drives
    512GB NVMe
TheVisitor said:
Thanks, my settings are like yours, but... still getting Security Center crashes when opening.
Click to expand...

Try a reset with this Power Shell command (Run as Administrator) and then reboot.

Get-AppxPackage Microsoft.SecHealthUI -AllUsers | Reset-AppxPackage
 

My Computer

System One

  • OS
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    Lenovo Yoga 920
    CPU
    Intel I7-8550U
    Motherboard
    n/a
    Memory
    16GB
    Graphics Card(s)
    Intel Graphics UHD 620
    Sound Card
    Realtek High Definition Audio (SST)
    Monitor(s) Displays
    4k Touch screen
    Screen Resolution
    3480 x 2160
    Hard Drives
    512GB NVMe
Did Microsoft remove the toggle for Kernel Mode Hardware Enforced Stack Protection?
First I had the warning about LSA not being enabled. Then LSA disapperared only to be replaced with Kernel Mode Hardware Enforced Stack Protection. Now the warning about LSA is back. I have however enabled LSA via the registry. But I can't find any information about where the option to enable Kernel Mode Hardware Enforced Stack Protection went.

​

 

My Computer

System One

  • OS
    Windows 11
Yeahoww said:
Did Microsoft remove the toggle for Kernel Mode Hardware Enforced Stack Protection?
First I had the warning about LSA not being enabled. Then LSA disapperared only to be replaced with Kernel Mode Hardware Enforced Stack Protection. Now the warning about LSA is back. I have however enabled LSA via the registry. But I can't find any information about where the option to enable Kernel Mode Hardware Enforced Stack Protection went.

​

Click to expand...
Hello, :alien:

Kernel Mode Hardware Enforced Stack Protection is a separate setting than LSA.

www.elevenforum.com

Enable or Disable Kernel-mode Hardware-enforced Stack Protection in Windows 11 Tutorial

This tutorial will show you how to enable or disable Kernel-mode Hardware-enforced Stack Protection for all users in Windows 11. Core isolation is a security feature of Microsoft Windows that protects important core processes of Windows from malicious software by isolating them in memory. It...
www.elevenforum.com www.elevenforum.com

The Microsoft article can give more details about it.

techcommunity.microsoft.com

Windows 11, version 22H2 Security baseline

Microsoft is pleased to announce the release of the security baseline package for Windows 11, version 22H2!
techcommunity.microsoft.com
 

My Computers

System One System Two

  • OS
    Windows 11 Pro for Workstations
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom self build
    CPU
    Intel i7-8700K 5 GHz
    Motherboard
    ASUS ROG Maximus XI Formula Z390
    Memory
    64 GB (4x16GB) G.SKILL TridentZ RGB DDR4 3600 MHz (F4-3600C18D-32GTZR)
    Graphics Card(s)
    ASUS ROG-STRIX-GTX1080TI-O11G-GAMING (11GB GDDR5X)
    Sound Card
    Integrated Digital Audio (S/PDIF)
    Monitor(s) Displays
    2 x Samsung Odyssey G75 27"
    Screen Resolution
    2560x1440
    Hard Drives
    1TB Samsung 990 PRO M.2,
    4TB Samsung 990 PRO M.2,
    8TB WD MyCloudEX2Ultra NAS
    PSU
    Seasonic Prime Titanium 850W
    Case
    Thermaltake Core P3 wall mounted
    Cooling
    Corsair Hydro H115i
    Keyboard
    Logitech wireless K800
    Mouse
    Logitech MX Master 3
    Internet Speed
    1 Gbps Download and 35 Mbps Upload
    Browser
    Google Chrome
    Antivirus
    Microsoft Defender and Malwarebytes Premium
    Other Info
    Logitech Z625 speaker system,
    Logitech BRIO 4K Pro webcam,
    HP Color LaserJet Pro MFP M477fdn,
    APC SMART-UPS RT 1000 XL - SURT1000XLI,
    Galaxy S23 Plus phone
  • Operating System
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    HP Spectre x360 2in1 14-eu0098nr (2024)
    CPU
    Intel Core Ultra 7 155H 4.8 GHz
    Memory
    16 GB LPDDR5x-7467 MHz
    Graphics card(s)
    Integrated Intel Arc
    Sound Card
    Poly Studio
    Monitor(s) Displays
    14" 2.8K OLED multitouch
    Screen Resolution
    2880 x 1800
    Hard Drives
    2 TB PCIe NVMe M.2 SSD
    Internet Speed
    Intel Wi-Fi 7 BE200 (2x2) and Bluetooth 5.4
    Browser
    Chrome and Edge
    Antivirus
    Windows Defender and Malwarebytes Premium
Brink said:
Hello, :alien:

Kernel Mode Hardware Enforced Stack Protection is a separate setting than LSA.

www.elevenforum.com

Enable or Disable Kernel-mode Hardware-enforced Stack Protection in Windows 11 Tutorial

This tutorial will show you how to enable or disable Kernel-mode Hardware-enforced Stack Protection for all users in Windows 11. Core isolation is a security feature of Microsoft Windows that protects important core processes of Windows from malicious software by isolating them in memory. It...
www.elevenforum.com www.elevenforum.com

The Microsoft article can give more details about it.

techcommunity.microsoft.com

Windows 11, version 22H2 Security baseline

Microsoft is pleased to announce the release of the security baseline package for Windows 11, version 22H2!
techcommunity.microsoft.com
Click to expand...
Hello! :)

Yes, but did Microsoft remove the toggle for Kernel Mode Hardware Enforced Stack Protection under Core Isolation? I can't find it anymore.
 

My Computer

System One

  • OS
    Windows 11
Yeahoww said:
Hello! :)

Yes, but did Microsoft remove the toggle for Kernel Mode Hardware Enforced Stack Protection under Core Isolation? I can't find it anymore.
Click to expand...

I don't have it available, but it's possibly related to the same bug.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro for Workstations
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom self build
    CPU
    Intel i7-8700K 5 GHz
    Motherboard
    ASUS ROG Maximus XI Formula Z390
    Memory
    64 GB (4x16GB) G.SKILL TridentZ RGB DDR4 3600 MHz (F4-3600C18D-32GTZR)
    Graphics Card(s)
    ASUS ROG-STRIX-GTX1080TI-O11G-GAMING (11GB GDDR5X)
    Sound Card
    Integrated Digital Audio (S/PDIF)
    Monitor(s) Displays
    2 x Samsung Odyssey G75 27"
    Screen Resolution
    2560x1440
    Hard Drives
    1TB Samsung 990 PRO M.2,
    4TB Samsung 990 PRO M.2,
    8TB WD MyCloudEX2Ultra NAS
    PSU
    Seasonic Prime Titanium 850W
    Case
    Thermaltake Core P3 wall mounted
    Cooling
    Corsair Hydro H115i
    Keyboard
    Logitech wireless K800
    Mouse
    Logitech MX Master 3
    Internet Speed
    1 Gbps Download and 35 Mbps Upload
    Browser
    Google Chrome
    Antivirus
    Microsoft Defender and Malwarebytes Premium
    Other Info
    Logitech Z625 speaker system,
    Logitech BRIO 4K Pro webcam,
    HP Color LaserJet Pro MFP M477fdn,
    APC SMART-UPS RT 1000 XL - SURT1000XLI,
    Galaxy S23 Plus phone
  • Operating System
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    HP Spectre x360 2in1 14-eu0098nr (2024)
    CPU
    Intel Core Ultra 7 155H 4.8 GHz
    Memory
    16 GB LPDDR5x-7467 MHz
    Graphics card(s)
    Integrated Intel Arc
    Sound Card
    Poly Studio
    Monitor(s) Displays
    14" 2.8K OLED multitouch
    Screen Resolution
    2880 x 1800
    Hard Drives
    2 TB PCIe NVMe M.2 SSD
    Internet Speed
    Intel Wi-Fi 7 BE200 (2x2) and Bluetooth 5.4
    Browser
    Chrome and Edge
    Antivirus
    Windows Defender and Malwarebytes Premium
Brink said:
I don't have it available, but it's possibly related to the same bug.
Click to expand...
I have never seen Kernel Mode Hardware Enforced Stack Protection on any of my machines. 🤷‍♂️
 

My Computer

System One

  • OS
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    Lenovo Yoga 920
    CPU
    Intel I7-8550U
    Motherboard
    n/a
    Memory
    16GB
    Graphics Card(s)
    Intel Graphics UHD 620
    Sound Card
    Realtek High Definition Audio (SST)
    Monitor(s) Displays
    4k Touch screen
    Screen Resolution
    3480 x 2160
    Hard Drives
    512GB NVMe
fg2001gf11F said:
I have never seen Kernel Mode Hardware Enforced Stack Protection on any of my machines. 🤷‍♂️
Click to expand...
It requires kinda new hardware to support it. Zen 3 and later AMD processors and 11th generation and newer from Intel if I remember correctly.

You can actually verify if you have it running by going to Task manager -> Details -> Right click on any of the columns at the top -> Select columns -> Click Hardware Enforced Stack Protection. If it's running it should say: "Compatible Modules Only" on each of the programs that can utilize it.
If it's not enabled all programs should say "Disabled".

Even if it's enabled some programs will still have it Disabled.
 

My Computer

System One

  • OS
    Windows 11
Yeahoww said:
It requires kinda new hardware to support it. Zen 3 and later AMD processors and 11th generation and newer from Intel if I remember correctly.

You can actually verify if you have it running by going to Task manager -> Details -> Right click on any of the columns at the top -> Select columns -> Click Hardware Enforced Stack Protection. If it's running it should say: "Compatible Modules Only" on each of the programs that can utilize it.
If it's not enabled all programs should say "Disabled".

Even if it's enabled some programs will still have it Disabled.
Click to expand...
This is the processor:
11th Gen Intel(R) Core(TM) i9-11900K @ 3.50GHz 3.40 GHz

I don't see Hardware Enforced Stack Protection in T.M. 🤷‍♂️
 

My Computer

System One

  • OS
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    Lenovo Yoga 920
    CPU
    Intel I7-8550U
    Motherboard
    n/a
    Memory
    16GB
    Graphics Card(s)
    Intel Graphics UHD 620
    Sound Card
    Realtek High Definition Audio (SST)
    Monitor(s) Displays
    4k Touch screen
    Screen Resolution
    3480 x 2160
    Hard Drives
    512GB NVMe
fg2001gf11F said:
This is the processor:
11th Gen Intel(R) Core(TM) i9-11900K @ 3.50GHz 3.40 GHz

I don't see Hardware Enforced Stack Protection in T.M. 🤷‍♂️
Click to expand...
Weird, I see no support for intel CET on this processor:
ark.intel.com

Intel® Core™ i9-11900K Processor (16M Cache, up to 5.30 GHz) Product Specifications

Intel® Core™ i9-11900K Processor (16M Cache, up to 5.30 GHz) quick reference guide including specifications, features, pricing, compatibility, design documentation, ordering codes, spec codes and more.
ark.intel.com ark.intel.com
Scroll down and look for Intel® Control-Flow Enforcement Technology under Security & Reliability.

Compare it to this processor for example:

Intel® Core™ i5-12600K Processor (20M Cache, up to 4.90 GHz) - Product Specifications | Intel

Intel® Core™ i5-12600K Processor (20M Cache, up to 4.90 GHz) quick reference with specifications, features, and technologies.
www.intel.com www.intel.com

Intel® Control-Flow Enforcement Technology is required for Hardware Enforced Stack Protection on Intel processors.
 

My Computer

System One

  • OS
    Windows 11
Yeahoww said:
Weird, I see no support for intel CET on this processor:
ark.intel.com

Intel® Core™ i9-11900K Processor (16M Cache, up to 5.30 GHz) Product Specifications

Intel® Core™ i9-11900K Processor (16M Cache, up to 5.30 GHz) quick reference guide including specifications, features, pricing, compatibility, design documentation, ordering codes, spec codes and more.
ark.intel.com ark.intel.com
Scroll down and look for Intel® Control-Flow Enforcement Technology under Security & Reliability.

Compare it to this processor for example:

Intel® Core™ i5-12600K Processor (20M Cache, up to 4.90 GHz) - Product Specifications | Intel

Intel® Core™ i5-12600K Processor (20M Cache, up to 4.90 GHz) quick reference with specifications, features, and technologies.
www.intel.com www.intel.com

Intel® Control-Flow Enforcement Technology is required for Hardware Enforced Stack Protection on Intel processors.
Click to expand...
OK thanks, looks like it is not there on my Gen 11 Intel processor.
 

My Computer

System One

  • OS
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    Lenovo Yoga 920
    CPU
    Intel I7-8550U
    Motherboard
    n/a
    Memory
    16GB
    Graphics Card(s)
    Intel Graphics UHD 620
    Sound Card
    Realtek High Definition Audio (SST)
    Monitor(s) Displays
    4k Touch screen
    Screen Resolution
    3480 x 2160
    Hard Drives
    512GB NVMe
You must log in or register to reply here.

Similar Windows 11 Tutorials

  • Article
Privacy and Security Verify Local Security Authority (LSA) Protection in Windows 11
Replies
0
Views
1K
Brink
Brink
  • Article
Accounts Enable or Disable Microsoft Accounts in Windows 11
Replies
0
Views
2K
Brink
Brink
  • Article
System Enable or Disable Create Dev Drive in Windows 11
Replies
0
Views
2K
Brink
Brink
  • Article
Browsers and Mail Enable or Disable Browse as Guest in Microsoft Edge
Replies
0
Views
507
Brink
Brink
  • Article
Apps Enable or Disable "Pin to taskbar" for Microsoft Store app in Windows 11
Replies
0
Views
1K
Brink
Brink
  • Article
Devices Enable or Disable Windows Protected Print Mode in Windows 11
Replies
0
Views
4K
Brink
Brink
  • Article
Browsers and Mail Enable or Disable Bypass Enhanced Security Mode in Microsoft Edge
Replies
0
Views
3K
Brink
Brink

Latest Support Threads

Latest Tutorials

Back
Top Bottom