How to Enable or Disable Local Security Authority Protection Nowadays, protecting authentication and credentials is more critical than ever. Luckily, Windows 11 includes a powerful security feature called Local Security Authority or LSA protection. We'll explain what it is, why it matters, and how to enable or disable it. Before we begin, be sure to subscribe to NinjaOne's IT Video Hub and our YouTube channel for more tech content like this. What Is Local Security Authority Protection? The Local Security Authority, or LSA is the gatekeeper of Windows security. It verifies credentials, manages password changes, and issues access tokens when users log in. For this reason, the LSA subsystem or LSASS is a high-value target for attackers. The good news is that with LSA protection enabled, LSASS runs as a protected process. This means even admin-level malware can’t inject malicious code, making it much harder for attackers to steal credentials or compromise the system. Why Enable or Disable LSA Protection? Enabling LSA protection is strongly recommended. It prevents credential dumping, supports modern security features like VBS, Secure Boot, Credential Guard, and aligns with Microsoft’s security baselines. However, in some cases, you may need to temporarily disable it— for example, when troubleshooting compatibility issues with older drivers, unsigned LSA plug-ins, and legacy software or during lab testing. How to Enable or Disable LSA Protection There are three ways to enable or disable LSA protection, depending on your environment and needs. Let's start with the simplest one: via the Windows Security app. First, go to Settings and then Privacy & Security. Under Device Security, select Core isolation details. There, toggle Local Security Authority protection on or off, and then reboot your device. Method 2 — Registry Editor For more control, IT admins can use the Registry Editor. Start by navigating to this key: HKEY_LOCAL_MACHINE\SYSTEM\ CurrentControlSet\Control\Lsa Set the value of RunAsPPL to 1 to enable LSA protection or 0 to disable it. Optionally, set the value of RunAsPPLBoot to 1 for protection at startup. Then restart your computer. Method 3 — PowerShell Lastly, for automation or bulk deployments, use PowerShell. Simply run PowerShell as an administrator and use this command to enable protection... Then reboot your PC. Change the value to 0 if you need to disable protection. In the end, by enabling LSA protection in Windows 11, your hardening authentication, reducing attack surfaces, and aligning with modern zero-trust strategies. Whether through a simple toggle or enterprise-wide automation, this feature helps you strike the right balance between security and operational stability. For more information, check out our official blog post on enabling or disabling LSA protection, linked in the description below.