LSA protection setting gone, but instead staple protection setting appeared

I checked after last monthly update, if the LSA protection bug was fixed. But it still said, computer needs to be restarted.
A week later i got the yellow ! mark at defender icon, and checked if i need to dismiss the notification of the bug again.

But now the setting for LSA protection was gone, under core isolation settings.

Instead there is now a hardware based stack protection for kernel mode setting. Which caused the yellow ! mark, because it was off. But it said in the "notification" it is on......

How could that happen? And is that normal?

Got the same notification today. Had no issue, though, turning it on and reboot.

It's not gone, just turned on automatically now.
It looks like the stopped showing it in the Windows Security app because of the false "Off" warnings.
To check if turned on open event viewer

Verifying LSA protection​

To discover if LSA was started in protected mode when Windows started, search for the following WinInit event in the System log under Windows Logs:

• 12: LSASS.exe was started as a protected process with level: 4

Click to expand...

There are several write ups on the situation on most tech sites:
Microsoft Defender update causes Windows Hardware Stack Protection mess
Windows 11 kernel-mode hardware-enforced stack protection is off error spotted

The feature is still in use as @Cliff S states, the main issue seems to be drivers (game anti-cheat and some mouse drivers in particular) causing problems for some at the moment and Defender not able to show which drivers are not compatible. Also there was/ is no information from Microsoft relating to the change although they appear to be aware of the issues being reported.

Cliff S said:

It's not gone, just turned on automatically now.
It looks like the stopped showing it in the Windows Security app because of the false "Off" warnings.
To check if turned on open event viewer

Configure added LSA protection

Learn how to configure added protection for the Local Security Authority (LSA) process to prevent code injection that could compromise credentials.

learn.microsoft.com

View attachment 58397

Click to expand...

Does this only work if Memory Integrity/Core Isolation is active as I don't see this in Event viewer?

BrianInEngland said:

Does this only work if Memory Integrity/Core Isolation is active as I don't see this in Event viewer?

Click to expand...

As far as I know, yes, it needs to be turned on.

Cliff S said:

As far as I know, yes, it needs to be turned on.

Click to expand...

OK, thanks

So this morning I got an update for Windows Defender Antimalware Platform 1.0.2303.28002-0. Now I have the LSA toggle available and set to ON (even though I don't have Memory Integrity enabled). I get the yellow triangle warning on every restart unless I dismiss it.

Will MS ever get this right?!

Also every time I check for updates the Antimalware update 1.0.2303.27001-0 attempts to re-install

BrianInEngland said:

So this morning I got an update for Windows Defender Antimalware Platform 1.0.2303.28002-0. Now I have the LSA toggle available and set to ON (even though I don't have Memory Integrity enabled). I get the yellow triangle warning on every restart unless I dismiss it.

Will MS ever get this right?!

Also every time I check for updates the Antimalware update 1.0.2303.27001-0 attempts to re-install

Click to expand...

I also got this 2303.28002, and everything seems fine. I have memory Integrity ON.

This was a known issue when trying to turn on LSA from Windows Security. It shows as resolved as of 5/03/2023, but some are still having the same issue, and nothing to worry about.


You can use option 2 or 4 in the tutorial below to enable LSA again without the warning.

I had
(Version 1.0.2303.28002) this morning, and ran a check for updates and got the other version back.
I've since blocked it 'hide update' but how do we get the newer version back ? I keep checking for windows updates and just
getting Intelligence updates.

I used Cliff's search in the event log to confirm LSA started correctly, but Every time I do a Check for Updates I get a very quick flash of the Platform being installed again. I can verify this by the repetitive entries in Reliability History. No errors anywhere I can see related to this. Just very odd. I cleared out Software Distribution and ran the WU Reset batch file. Hopefully it will clear up. FWIW, this only is happening on RTM, not RP or Beta or Canary or Dev.

p.s. - I also got the 27002 platform earlier, and it reverted back to the 27001.

f14tomcat said:

I used Cliff's search in the event log to confirm LSA started correctly, but Every time I do a Check for Updates I get a very quick flash of the Platform being installed again. I can verify this by the repetitive entries in Reliability History. No errors anywhere I can see related to this. Just very odd. I cleared out Software Distribution and ran the WU Reset batch file. Hopefully it will clear up. FWIW, this only is happening on RTM, not RP or Beta or Canary or Dev.

p.s. - I also got the 27002 platform earlier, and it reverted back to the 27001.

View attachment 59415

Click to expand...

I'm getting it on RP

BrianInEngland said:

I'm getting it on RP

Click to expand...

Weird, my insider R.P., Beta and Dev, look fine with this latest kb5007651 1.0.2303.28002-0, but all my public builds 22621.1635 with the same update are missing the LSA toggle switch in Core Isolation settings.
All the registry settings are the same, I wonder what is hiding the LSA toggle switch?
Must be another screw-up from MS.
The LSA toggle switch seems completely useless because it does not change the registry entries according to the switch settings. So, it causes problems either when on or off unless we set the registry entries to match.
The registry entries should change automatically on reboot based on the toggle switch being on or off.
Must be A.I. logic, aka Absolute Idiocy.

This is R.P. and the same on Beta:

BrianInEngland said:

I'm getting it on RP

Click to expand...

Interesting that this is what hides the LSA toggle switch in Security Settings.
Another experimental feature that MS disabled in all my public builds.

[40025975] (EnablePplForConsumers)
Priority : Service (4)
State : Disabled (1)
Type : Experiment (1)

fg2001gf11F said:

Interesting that this is what hides the LSA toggle switch in Security Settings.
Another experimental feature that MS disabled in all my public builds.

[40025975] (EnablePplForConsumers)
Priority : Service (4)
State : Disabled (1)
Type : Experiment (1)

Click to expand...

Not that it makes a lot of difference, more psychological than anything, but it looks a lot better! Did Vive Tool on it. Thank you!

f14tomcat said:

Not that it makes a lot of difference, more psychological than anything, but it looks a lot better! Did Vive Tool on it. Thank you!

Click to expand...

Thanks for the confirmation.
Currently that toggle switch is quite useless because the related registry entries are not automatically set accordingly to the ON or OFF status.
At least it explains the inconsistency and how the switch disappeared from Settings.
Today they keep downloading the 27001 version. Why?
Crazy!

fg2001gf11F said:

Thanks for the confirmation.
Currently that toggle switch is quite useless because the related registry entries are not automatically set accordingly to the ON or OFF status.
At least it explains the inconsistency and how the switch disappeared from Settings.
Today they keep downloading the 27001 version. Why?
Crazy!

View attachment 59461

Click to expand...

I get all that, too. I might try blocking it with WUMT.

The whole Security updates thing is a mess! Different versions, wrong versions, features missing or not working for some users, app crashing

BrianInEngland said:

The whole Security updates thing is a mess! Different versions, wrong versions, features missing or not working for some users, app crashing

Click to expand...

Here is an FBH report for Beta 22624.1690: