Is LSA no longer enabled by default?

milkturnipsbage · May 11, 2023

So, I have recently installed new out of the box computers at work. After getting the latest Windows updates some of the problems that other people have described here have started. Broken Windows Security UI with Randomly dissapearing TPM and LSA warning messages.
What's the deal with LSA now? Should it be enabled by default even though the setting for turning it on is now missing from Windows Security?

Going to Event viewer to confirm if it's running or not and I find no instance of LSA running as a protected process.
I go to Windows logs -> System -> Filter -> Wininit and all I find are:
VBS Key Isolation and Credential guard. So what's the deal?
Kernel Mode Hardware Enfored Stack Protection got removed from Windows Security aswell as the option to enable LSA.
Should it be enabled by default?

neemobeer · May 11, 2023

Correction, looks like it's enabled by default now.

Scott · May 11, 2023

LSA protection setting gone, but instead staple protection setting appeared

Here is an FBH report for Beta 22624.1690: https://aka.ms/AAkoli0 Thanks, I upvoted.

www.elevenforum.com

milkturnipsbage · May 12, 2023

neemobeer said:
Correction, looks like it's enabled by default now.

That’s the problem, because it’s not enabled by default. I see nothing about LSA in event viewer. I was going to verify that it was running as a secured process but I find nothing.

Have verified this on several new installations. Does Microsoft think that we should enable this in regedit?

RFS · May 12, 2023

You can check the status in settings / privacy and security / windows security / device security / core isolation and then click on core isolation details.

All my systems show LSA enabled.

milkturnipsbage · May 12, 2023

RFS said:
You can check the status in settings / privacy and security / windows security / device security / core isolation and then click on core isolation details.

All my systems show LSA enabled.

Not on these new devices. LSA first got replaced with Kernel Mode Hardware Enforced Stack Protection, just to get replaced by LSA again, until recently when Microsoft removed the option enable LSA in the latest update.
More information here: LSA option missing completely

Did you manually enable LSA through regedit before?

Ulqi · Oct 26, 2023

Hello, just want to check in on this... I noticed that I don't have LSA enabled and when i press Core isolation it just gives me this ->

I tried to enable LSA protection Manually via syshardener but didn't work.
I have an i9 9900k, with windows 11 22h version.. should i be able to enable it? Why couldn't i? Why can't i see the page even?

Thanks in advance