iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If Windows Security says “Local Security Authority protection is off,” first check whether protection is actually disabled: Microsoft documented a 2023 Defender platform issue that could leave the warning and restart prompt visible after protection had been enabled. The fix depends on your Windows 11 version, whether the PC is managed by an organization, and whether the alert reflects the setting or a stale notification.
What the warning means
Local Security Authority (LSA) validates local and remote sign-ins and enforces local security policies. LSA protection adds safeguards around the Local Security Authority Subsystem Service (LSASS), which handles credentials. Microsoft Learn says, “This feature provides added security for the credentials that LSA stores and manages.” The protection is intended to prevent nonprotected processes from reading LSA memory or injecting code.
The alert is a status message, not proof on its own that protection is currently off. Microsoft documented a case in which the warning persisted after users enabled the feature. Check the setting and the device’s update state before deciding that the warning is either accurate or harmless.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Check your Windows version and whether the device is managed
Open Settings > System > About and check the Windows edition and version. Microsoft’s individual-device configuration guidance covers Windows 11 version 22H2 and later for the documented Local Group Policy route and for enforcing the registry value that enables protection without a UEFI variable.
#1 Best Overall
- Connectivity: Includes WiFi, Bluetooth, and LAN for wireless and wired connections
- Memory: Features 16GB DDR4 RAM for smooth multitasking and performance
- Storage: Combines 500GB SSD and 1TB HDD for ample storage space
- Graphics: Integrated Intel UHD Graphics 630 for crisp visuals and video playback
- Design: Sleek desktop tower with black color and slim profile for modern look
If the PC belongs to your employer or school, contact its IT administrator before changing registry or policy settings. Organizations can configure LSA protection through domain Group Policy or Intune, and local changes may conflict with their policy.
Choose the configuration that fits your PC
| Configuration | What it means | Important detail |
|---|---|---|
| RunAsPPL value 1 | Enables protection with a UEFI variable. | With UEFI lock, the setting is stored in firmware and cannot be removed simply by changing the registry or policy. Microsoft documents a separate opt-out process. |
| RunAsPPL value 2 | Enables protection without a UEFI variable. | Microsoft says this value is enforced only on Windows 11 version 22H2 and later. |
| Organization-managed configuration | Configured centrally through domain Group Policy or Intune. | Follow the organization’s administrator policy rather than applying a local workaround. |
Microsoft says the no-UEFI-variable configuration is applied by default on devices with a new installation of Windows 11 version 22H2 or later. That is not a claim that every Windows 11 PC has protection enabled: Microsoft’s automatic enablement conditions include version 22H2 or later, a new installation rather than an upgrade, an enterprise join, and HVCI capability.
Enable protection on an individual PC
Before changing the registry, consider compatibility. Some LSA plug-ins or drivers that do not meet signing requirements may fail to load when protection is enabled. Microsoft recommends auditing compatibility and testing before broad deployment; audit mode is enabled by default on Windows 11 version 22H2 and later.
Rank #2
- [INTEL POWERED CONTENT] - Built with a 8th Generation Hexa-Core Intel i5 and 32GB of DDR4 RAM; Modern, Windows 11 ready, with 4K support, Executive multitasking, media streaming and smooth, multi-tab web browsing; Perfect as an all-purpose multimedia computer; built for content creators; Plenty of RAM and Mass storage for photo and video editing powered by Intel HD 630
- [LATEST WIRELESS TECH] - This Dell Desktop Computer easily connects to the internet through the Built In WiFi / Bluetooth
- [SOLID STATE STORAGE] - This Dell Computer setup comes with an ultra-fast 1TB Solid State Drive (SSD); Setup as the primary boot device; Boot and load programs with lightning speed ; Additional expansion available
- [BUY & OWN WITH CONFIDENCE] - From the world's largest Microsoft Authorized Refurbisher; Quality Guarantee and Free Tech Support; Award-winning Customer Service; | Support Sustainable Business
- [MODERN HI-SPEED PORTS] - USB 3.0 (x4) | USB 2.0 (x4) | DisplayPort (x1) | HDMI Port (x1) | Audio Combo Jack (x1) | Audio Out (x1) | RJ-45 Ethernet (x1) | Internal SATA (x3)
Use the registry
- Open Registry Editor and go to
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlLsa. - Set the
RunAsPPLvalue to1to enable protection with a UEFI variable, or to2to enable it without one. The value2is enforced only on Windows 11 version 22H2 and later. - Restart Windows for the configuration change to take effect.
Changing a registry value is not a way to remove UEFI-locked protection. Microsoft’s documentation describes a separate opt-out procedure for that configuration.
Use Local Group Policy
For an individual device, Microsoft documents Local Group Policy configuration on Windows 11 version 22H2 and later. Open the Local Group Policy Editor, follow Microsoft’s Configure added LSA protection guide for the applicable policy and configuration, then restart Windows. The guide also documents the registry route and the differences between UEFI-locked and non-UEFI configurations.
If the warning stays after you enable protection
Check for the documented 2023 Defender platform issue
Microsoft documented a historical false-warning and repeated-restart-prompt issue involving Defender antimalware platform KB5007651 version 1.0.2302.21002. The notice covered Windows 11 versions 21H2 and 22H2 and displayed the message “Local Security protection is off. Your device may be vulnerable.” Microsoft said other Windows updates released March 14, 2023—KB5023706 and KB5023698—did not cause that particular issue. It was resolved in Defender platform KB5007651 version 1.0.2303.27001.
Rank #3
- Model: Dell OptiPlex 7050 Small Form Factor (SFF)
- Processor: Intel Core i7-7700 3.60 GHz
- Memory: 32GB DDR4 Ram
- Storage: 1TB Solid State Drive (SSD) Fast Boot + Storage
- Operating System: Windows 11 Pro (64-bit)
For that specific incident, Microsoft’s documented workaround was to enable LSA protection, restart at least once, dismiss repeat warnings, and verify the status in Event Viewer. The notice stated: “Important: Currently, we do not recommend any other workaround for this issue.” That advice concerns the historical issue only; it does not establish that a warning on a current PC is false. The notice is reproduced on Microsoft Q&A. Check current Windows and Defender update information for your device before drawing conclusions about a present-day build.
Verify the setting rather than repeatedly toggling it
If you have enabled the feature and restarted but the alert remains, verify the device’s protection status in Event Viewer as Microsoft described for the historical incident. Also check Windows Update and Defender platform status. If the PC is managed, ask the administrator to confirm the applied policy. A persistent notification is a reason to verify status, not to assume that repeated setting changes or third-party repair tools are needed.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When to stop and ask an administrator
- Your PC is managed by an employer or school, or its security settings are controlled by policy.
- You rely on LSA plug-ins or drivers and enabling protection causes authentication or compatibility problems.
- The device uses UEFI-locked protection and you need to disable it; changing the registry alone will not remove the firmware setting.
For Microsoft’s supported configuration details, see Configure added LSA protection. For the historical notification issue, see the Microsoft Q&A reproduction of the release-health notice.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
