Local Security Authority (LSA) Protection is a core Windows 11 security feature designed to protect sensitive authentication data such as credentials and password hashes. When enabled, it helps prevent credential theft by isolating the Local Security Authority Subsystem Service (LSASS) from malicious access. If Windows shows “Local Security Authority protection is off”, your system may be more vulnerable to advanced attacks.
This warning commonly appears after Windows updates, system upgrades, or changes to security and registry settings. In some cases, LSA Protection is already enabled at the system level, but Windows Security continues to show a warning due to a configuration mismatch or pending restart.
Fixing the LSA Protection is off warning in Windows 11 involves enabling the feature correctly through Windows Security, ensuring required registry values are set, and keeping the system fully updated. The steps below explain how to resolve the issue safely.
How to Fix Local Security Authority (LSA) Protection Is Off in Windows 11
The methods in this section focus on enabling LSA Protection properly and clearing false warnings that may appear in Windows Security. Follow the steps in order and restart the system when instructed.
1. Enable LSA Protection from Windows Security
This is the recommended and safest method.
- Open Windows Security from the Start menu.
- Go to Device security.
- Select Core isolation details.
- Locate Local Security Authority protection.
- Turn the toggle On.
- Restart your computer when prompted.
After restart, Windows should protect LSASS automatically.
2. Restart the Computer to Apply Changes
LSA Protection requires a full reboot.
- Save all open work.
- Restart the system normally.
- After signing back in, open Windows Security.
- Check if the warning is cleared.
A simple restart often resolves false alerts.
3. Update Windows 11 to the Latest Version
Known LSA warning bugs were fixed in later updates.
- Open Settings.
- Go to Windows Update.
- Click Check for updates.
- Install all available updates.
- Restart the computer.
Keeping Windows updated ensures security features work correctly.
4. Enable LSA Protection Using Registry Editor
Use this method if the toggle is missing or not working.
- Press Windows + R, type regedit, and press Enter.
- Navigate to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa - Create or modify the following DWORD (32-bit) values:
RunAsPPLset to 1RunAsPPLBootset to 1
- Close Registry Editor.
- Restart the computer.
These values force LSA Protection at startup.
5. Verify LSA Protection Is Actually Enabled
You can confirm LSA Protection status.
- Press Windows + R, type eventvwr, and press Enter.
- Go to Windows Logs > System.
- Look for events related to LSASS running as a protected process.
This confirms that LSA Protection is active even if the warning persists.
6. Check for Conflicting Third-Party Security Software
Some security tools interfere with LSA settings.
- Temporarily disable third-party antivirus software.
- Restart the system.
- Check Windows Security again.
- Re-enable antivirus after testing.
Ensure the security software supports Windows 11 LSA Protection.
7. Repair System Files
System corruption can cause incorrect security warnings.
- Open Terminal (Admin).
- Run the following command:
sfc /scannow - After completion, run:
DISM /Online /Cleanup-Image /RestoreHealth - Restart the computer.
Repairing system files restores security component integrity.
8. Clear Windows Security App Cache
A cached warning can persist incorrectly.
- Open Settings.
- Go to Apps > Installed apps.
- Locate Windows Security.
- Click Advanced options.
- Select Reset.
- Restart the system.
This refreshes Windows Security status indicators.
Final Thoughts
The Local Security Authority (LSA) Protection is off warning in Windows 11 is often caused by incomplete updates, missing registry values, or delayed system restarts rather than an actual security failure. In many cases, LSA Protection is already active even when the warning is visible.
