Solved Local Security Authority is off.

raphaelmsx · May 12, 2023

Hi people.

Running Win11 22H2 22621.1702 here, and since yesterday I'm receiving this message in Windows Security, then I click "Go to settings" and it opens Core Isolation, but there's nothing else to turn it on. Rebooted, to no avail.

What can I do to fix it?

Thanks!

Brink · May 12, 2023

Hello, and welcome.

This is a bug, but LSA is actually still running.

You can verify that LSA protection is enabled by looking in Event Viewer using the information available here.

You can use option 2 or 4 in the tutorial below to enable LSA again without the warning. Currently the LSA setting is missing in Windows Security since Build 22621.1635. We'll have to wait for a fix to get the toggle back in Windows Security.

Enable or Disable Local Security Authority (LSA) Protection in Windows 11 Tutorial

This tutorial will show you how to enable or disable Local Security Authority (LSA) protection for all users in Windows 11. Core isolation is a security feature of Microsoft Windows that protects important core processes of Windows from malicious software by isolating them in memory. It does...

www.elevenforum.com

raphaelmsx · May 12, 2023

Thanks! I fixed with option two.

Brink · May 12, 2023

Great news. You're most welcome.

adriancornea52 · May 27, 2023

Hello everyone. I have the same problem as raphaelmsx. I did what is says here: Configuring Additional LSA Protection and couldn't find any event like that. So it means that LSA is indeed off.

I appreciate your advice, Brink, but I don't feel comfortable to change the registry until an official Microsoft fix doesn't appear. What if I do the registry change, and when the official fix comes it isn't compatible with the workaround I did? I just hope Microsoft is aware of these problems.

To tell you some of the story: Since about 4th of May, Windows Security has started to warn me that Local Security Authority protection is off. When I enter Device Security, in Core Isolation, simply there is no option to turn LSA on or off... As you can see in the screenshot also. I don't think I had this problem before 4th of May. Coincidentally or not, on 4th of May, before the problem started (most probably), the Windows Security antimalware platform update has been installed (KB5007651, Version 1.0.2303.28002) through automatic updates on my computer. So I think maybe the update and the problem are connected?

I even reinstalled Windows, hoping this problem would go away, but some time after the reinstallation the same warning appeared. It appeared after I turned on Memory integrity (it wasn't turned on by default after the install), so maybe it is connected with this?

I have written in the Feedback Hub also. Apparently there are others there who have this problem also, there is a collection of topics with this problem that has 520 upvotes.

Also, maybe you can please help me with the following question? Why does it say "Standard hardware security not supported"? You can check my specs, are they not good enough?
Thank you!

milkturnipsbage · Jun 2, 2023

adriancornea52 said:
Hello everyone. I have the same problem as raphaelmsx. I did what is says here: Configuring Additional LSA Protection and couldn't find any event like that. So it means that LSA is indeed off.

I appreciate your advice, Brink, but I don't feel comfortable to change the registry until an official Microsoft fix doesn't appear. What if I do the registry change, and when the official fix comes it isn't compatible with the workaround I did? I just hope Microsoft is aware of these problems.

To tell you some of the story: Since about 4th of May, Windows Security has started to warn me that Local Security Authority protection is off. When I enter Device Security, in Core Isolation, simply there is no option to turn LSA on or off... As you can see in the screenshot also. I don't think I had this problem before 4th of May. Coincidentally or not, on 4th of May, before the problem started (most probably), the Windows Security antimalware platform update has been installed (KB5007651, Version 1.0.2303.28002) through automatic updates on my computer. So I think maybe the update and the problem are connected?

I even reinstalled Windows, hoping this problem would go away, but some time after the reinstallation the same warning appeared. It appeared after I turned on Memory integrity (it wasn't turned on by default after the install), so maybe it is connected with this?

I have written in the Feedback Hub also. Apparently there are others there who have this problem also, there is a collection of topics with this problem that has 520 upvotes.
View attachment 61108 View attachment 61106

Also, maybe you can please help me with the following question? Why does it say "Standard hardware security not supported"? You can check my specs, are they not good enough?
Thank you!

This has been a problem for months now. Microsoft added the LSA protection toggle to Device Security, just to later remove it. Now the error is still there even tough the option to enable LSA is not present. You can manually enable LSA by editing the registry through regedit. There are tutorials on how to do this, Enable or Disable Local Security Authority (LSA) Protection in Windows 11 Tutorial for example.

Regarding the "Standard hardware security not supported" message, it seems that Secure Boot is missing. Have you enabled Secure Boot (UEFI) in BIOS?

adriancornea52 · Jun 2, 2023

Hellon Yeahoww. From what is says here, on a Microsoft official site: Device protection in Windows Security - Microsoft Support
Standard hardware security not supported - This means that your device does not meet at least one of the requirements of standard hardware security. The list of requirements is given a bit earlier on that site:

TPM 2.0 (also referred to as your security processor)
Secure boot enabled
DEP
UEFI MAT

My laptop has TPM 2.0 enabled. I verified it. So my device has at least one of the requirements. Then, either that Microsoft article has errors, or there is some bug in my system.

As for the LSA problem, thanks for confirming the bug. About the fix you suggested, as I said I don't feel comfortable changing the registry before an official fix comes. It may cause problems for when the fix comes.

milkturnipsbage · Jun 2, 2023

adriancornea52 said:
Hellon Yeahoww. From what is says here, on a Microsoft official site: Device protection in Windows Security - Microsoft Support
Standard hardware security not supported - This means that your device does not meet at least one of the requirements of standard hardware security. The list of requirements is given a bit earlier on that site:

TPM 2.0 (also referred to as your security processor)

Secure boot enabled

DEP

UEFI MAT

My laptop has TPM 2.0 enabled. I verified it. So my device has at least one of the requirements. Then, either that Microsoft article has errors, or there is some bug in my system.

As for the LSA problem, thanks for confirming the bug. About the fix you suggested, as I said I don't feel comfortable changing the registry before an official fix comes. It may cause problems for when the fix comes.

Well, the portion of Secure Boot is missing from your Device Security screenshot. Secure Boot must be enabled to show up in Device Security, otherwise it will give you that error of Standard security not met. See my attachment.

What motherboard do you have? ASUS laptop? See the instructions on this site: [Motherboard] How to enable or disable Secure Boot ? | Official Support | ASUS Global
I bet that OS type is set to "Other" instead of "Windows UEFI mode".

adriancornea52 · Jun 4, 2023

Yeahoww said:
Well, the portion of Secure Boot is missing from your Device Security screenshot. Secure Boot must be enabled to show up in Device Security, otherwise it will give you that error of Standard security not met. See my attachment.

What motherboard do you have? ASUS laptop? See the instructions on this site: [Motherboard] How to enable or disable Secure Boot ? | Official Support | ASUS Global
I bet that OS type is set to "Other" instead of "Windows UEFI mode".

I reiterate that according to that Microsoft article, my device should not receive the "Standard hardware security not supported" message since it meets at least one requirement (TPM 2.0).

But thank you for your suggestion, I will enable Secure Boot at some point and test if I still get the message.

milkturnipsbage · Jun 5, 2023

adriancornea52 said:
I reiterate that according to that Microsoft article, my device should not receive the "Standard hardware security not supported" message since it meets at least one requirement (TPM 2.0).

But thank you for your suggestion, I will enable Secure Boot at some point and test if I still get the message.

To my experience atleast TPM and Secure boot needs to be enabled to get Standard security. If you enable Memory Integrity you get the message enhanced security.