Solved Local Security Authority protection warning - legitimate, or false-positive?

safron · Mar 2, 2023

Hi - I'd posted this in the antivirus board, but it doesn't seem very active so I'm posting again here (I didn't see any way of deleting the old post).

I'm getting conflicting information from Windows Security regarding Local Security Authority protection (LSAp).

After installing WUS February updates
> 2023-02 .Net 6.0.14 Security Update KB5023288, and
> 2023-02 Cum Update for Windows KB5022845
I noticed "Windows security - Actions recommended" in the system tray.

In Windows Security > Device security:
> Memory integrity was Off. I toggled it to On.
> LSAp was Off. I toggled it to On.

I believe (?) both these settings were On prior to applying February updates.

After rebooting again, the toggle for LSAp now shows it's switched On, but there's still a warning saying it's off (see pic). The system tray icon also continues to show Actions recommended.

I researched a bit, and see on reddit ( Link ) others are having the same issue. They say something about a missing Registry entry, and creating a new DWORD32, but I didn't want to blindly mess with the Registry. Likewise, I have a restore point, but am not sure that's the best course, as I don't know if LSAp is truly Off, or On, and Windows is just displaying an erroneous message.

For now, I've elected not to do anything (except post here) and hope Microsoft applies a fix.

Has anyone here encountered this? Any suggestions will be appreciated.

Windows Build/Version22H2, Build 22621.1265

Attachments

LSAP.jpg
96.4 KB · Views: 1

glasskuter · Mar 2, 2023

Toggling LSAP to ON should have been all that was needed. An optional way of turning it on is using a reg file that does the same thing. Here is Brink's tutorial that includes the reg file. Try that method to see if the warning is removed. Enable or Disable Local Security Authority (LSA) Protection in Windows 11 Tutorial

safron · Mar 2, 2023

Thanks @glasskuter. The reg file in Brink's tutorial is consistent with what others were suggesting on Reddit.

I implemented changes in the Group Policy Editor, and set to Enable Local Security Authority (LSA) Protection without UEFI Lock, which is apparently the Win 11 default, but the issue persists (see pic).

SFC and DISM are all clear. This is looking more and more like a Windows bug.

safron · Mar 2, 2023

Per this link, (page 4) and Brink's reg file, it seems a missing Registry entry was the culprit.

In the Registry, we were in fact missing the RunAsPPLBoot key (which of course the Group Policy mod didn't address).

I reversed the Group Policy change, just to keep things clean.

I then implemented changes specified in Brink's reg file
a) adding the RunAsPPLBoot key, and
b) assigning dword = 2.

That did the trick. Notification in the system tray is gone, and Windows Security is no longer flagging LSAp as Off (even though the toggle was On).

Thanks again for your help @glasskuter (and of course Brink).

glasskuter · Mar 2, 2023

You're welcome. I donate my share of thanks to @Brink. He's the brains behind it. He does the work, we just provide the links.

safron · Mar 4, 2023

safron said:
Per this link, (page 4) and Brink's reg file, it seems a missing Registry entry was the culprit.

In the Registry, we were in fact missing the RunAsPPLBoot key (which of course the Group Policy mod didn't address).

I reversed the Group Policy change, just to keep things clean.

I then implemented changes specified in Brink's reg file
a) adding the RunAsPPLBoot key, and
b) assigning dword = 2.

That did the trick. Notification in the system tray is gone, and Windows Security is no longer flagging LSAp as Off (even though the toggle was On).

Thanks again for your help @glasskuter (and of course Brink).

Sorry - a and b in my post # 4 above should read:

a) adding the RunAsPPLBoot dword, and
b) assigning value= 2.

FrankW · Mar 16, 2023

glasskuter said:
Toggling LSAP to ON should have been all that was needed. An optional way of turning it on is using a reg file that does the same thing. Here is Brink's tutorial that includes the reg file. Try that method to see if the warning is removed. Enable or Disable Local Security Authority (LSA) Protection in Windows 11 Tutorial

Hi Glasskuter
After the March 14 update I got a yellow warning on my Windows Security notification icon. I turned on LSA but the yellow warning remains, I checked the registry (Brink's tutorial) and the first RunAsPPL is set to 00000002 but I don't have the "RunAsPPLBoot"=dword:00000002 entry (Windows11 22H2 Home) should I run Brink's script to include the second key? I checked my UEFI and Secure Boot is enabled.
Alternatively I dismiss the warning?
Frank

glasskuter · Mar 16, 2023

Yes, Frank. The reg file will create the key.

Fabler2 · Mar 16, 2023

It looks like 2023-03 Cumulative Update for Windows 11 Version 22H2 for x64-based Systems (KB5023706) turns LSAP to off. Only noticed it yesterday and had the same issue.

DigitalGoat · Mar 16, 2023

Not to take anything away from Brink, but if you click the 'learn more' link under the Defender item it will take you to the Microsoft page :
Configuring Additional LSA Protection

There are instructions and explanations there on how to correctly configure LSAp, including the registry settings and how to use Event Viewer to check the status of relevent files that might cause issues.

FrankW · Mar 16, 2023

glasskuter said:
Yes, Frank. The reg file will create the key.

Thanks @Brink and @glasskuter for your excellent support
Frank

Ultragravy · Mar 16, 2023

I've also had the same issue following the March 14th update - LSAP was set to off and toggling it on just keeps the yellow warning and tells me I need to restart to activate even after a reboot.

I'm not one to particularly enjoy fiddling with registry entries for no reason (not a super techy person!), so I'm inclined to just leave it off and tag the notification as Dismissed. Is this a particularly useful security setting for an average home user? If it's viewed as vital I'll deal with the registry entry issue but if the update itself is mass turning this setting off for people I'm inclined to leave it disabled!

DigitalGoat · Mar 16, 2023

Ultragravy said:
I've also had the same issue following the March 14th update - LSAP was set to off and toggling it on just keeps the yellow warning and tells me I need to restart to activate even after a reboot.

I'm not one to particularly enjoy fiddling with registry entries for no reason (not a super techy person!), so I'm inclined to just leave it off and tag the notification as Dismissed. Is this a particularly useful security setting for an average home user? If it's viewed as vital I'll deal with the registry entry issue but if the update itself is mass turning this setting off for people I'm inclined to leave it disabled!

If you read the MS page I linked you can decide for yourself if you need to resolve the issue or not, only you really know if your setup needs it on or off.

TheVisitor · Mar 16, 2023

DigitalGoat said:
Not to take anything away from Brink, but if you click the 'learn more' link under the Defender item it will take you to the Microsoft page :
Configuring Additional LSA Protection

There are instructions and explanations there on how to correctly configure LSAp, including the registry settings and how to use Event Viewer to check the status of relevent files that might cause issues.

Read thru that, and its over my head... however, how does this apply to Windows 'Home', ? There is stuff there that I'm sure is not part of Home.

wrogg · Mar 16, 2023

I was getting the same (Pro) since, there was a Defender platform update this morning, and now every other time I open Windows security I get "Windows security health service stopped working"
Tried repair and reset on Windows security.
SFC scannow (found and resolved)
DISM restore.

the Dword reg egit entries are indeed missing , however I didn't realise I was beta testing.

KB 5007651 was the little gem I received today

Ten Forward · Mar 16, 2023

DigitalGoat said:
Not to take anything away from Brink, but if you click the 'learn more' link under the Defender item it will take you to the Microsoft page :
Configuring Additional LSA Protection

There are instructions and explanations there on how to correctly configure LSAp, including the registry settings and how to use Event Viewer to check the status of relevent files that might cause issues.

There's no mention of RunAsPPLBoot in that article though.

I encountered this issue today at work and also here at home.

TVeblen · Mar 16, 2023

I got this after the update also.
I can't recall if I ever had this enabled when I clean installed Windows. Now I have questions:

If this a "silent" security feature - it runs in the background and never bothers me?
The description of it :

"is a process in Microsoft Windows that verifies logon attempts, password changes, creates access tokens, and other important tasks relating to Windows authentication and authorization protocols"

I have a Local Account - I don't log in, use passwords, access tokens, or a MS Account. It's not going to start nagging for any of those is it?

In Brink's tutorial Enable or Disable Local Security Authority (LSA) Protection in Windows 11 Tutorial :
What is the UEFI Lock option? Why would I or wouldn't I want to enable this?

safron · Mar 20, 2023

I just saw This post where Microsoft finally acknowledges this issue, which has apparently been going on since Jan 15, 2023. In the post, they say that LSA is ON, and that the warning is a false positive. They also include the registry mod to remove the warning, if desired.

wrogg · Mar 21, 2023

I just noticed Windows Defender had a *new* next to it? Checked updates, nothing there, but on the store it says updated today, don't think I've seen this before

safron · Mar 22, 2023

Follow-up question: Is cleanup recommended?

Background
To resolve the issue, I added the RunAsPPLBoot DWord with a value of 2 in the Registry under the [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] key.

Status
Microsoft has now acknowledged this issue as a bug (i.e., a false-positive) and said:

The erroneous notification can just be dismissed. After toggling LSA on, and rebooting LSA is on regardless of the notification.
Remedial action is NOT recommended. The erroneous notification should disappear with upcoming updates.

Question
Should I now remove the DWord I added, thereby "restoring" the Registry to a pre-modified state? Is there any downside to keeping this DWord under the LSA key if we want LSA enabled?

Solved Local Security Authority protection warning - legitimate, or false-positive?

Well-known member

Attachments​

My Computers My Computers

At a glance

At a glance

aka Mama Glass

My Computers My Computers

At a glance

At a glance

Well-known member

Attachments

My Computers My Computers

At a glance

At a glance

Well-known member

Attachments

My Computers My Computers

At a glance

At a glance

aka Mama Glass

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

Attachments

My Computers My Computers

At a glance

At a glance

aka Mama Glass

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

Attachments

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Attachments

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computers

My Computers

My Computers

My Computer

My Computers