Skip to content

Update LSA protection configuration documentation #8121

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
HerbertMauerer wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update LSA protection configuration documentation #8121

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions .../credentials-protection-and-management/configuring-additional-lsa-protection.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -240,12 +240,18 @@ For more information about managing Secure Boot, see [UEFI Firmware](/previous-v

## Verify LSA protection

# Check the status through events
To determine whether LSA starts in protected mode when Windows starts, take the following steps:

1. Open Event Viewer.
1. Expand **Windows Logs** > **System**.
1. Look for the following **WinInit** event: **12: LSASS.exe was started as a protected process with level: 4**.

# Check the current status from the registry
Comment on lines +243 to +250
Copy link

Copilot AI Feb 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These headings are using # (H1), which will break the document’s heading hierarchy under the existing ## Verify LSA protection section. Use a deeper heading level (for example ###) so they remain subsections of Verify LSA protection.

Suggested change
# Check the status through events
To determine whether LSA starts in protected mode when Windows starts, take the following steps:
1. Open Event Viewer.
1. Expand **Windows Logs** > **System**.
1. Look for the following **WinInit** event: **12: LSASS.exe was started as a protected process with level: 4**.
# Check the current status from the registry
### Check the status through events
To determine whether LSA starts in protected mode when Windows starts, take the following steps:
1. Open Event Viewer.
1. Expand **Windows Logs** > **System**.
1. Look for the following **WinInit** event: **12: LSASS.exe was started as a protected process with level: 4**.
### Check the current status from the registry

Copilot uses AI. Check for mistakes.
Comment on lines +243 to +250
Copy link

Copilot AI Feb 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These headings are using # (H1), which will break the document’s heading hierarchy under the existing ## Verify LSA protection section. Use a deeper heading level (for example ###) so they remain subsections of Verify LSA protection.

Suggested change
# Check the status through events
To determine whether LSA starts in protected mode when Windows starts, take the following steps:
1. Open Event Viewer.
1. Expand **Windows Logs** > **System**.
1. Look for the following **WinInit** event: **12: LSASS.exe was started as a protected process with level: 4**.
# Check the current status from the registry
### Check the status through events
To determine whether LSA starts in protected mode when Windows starts, take the following steps:
1. Open Event Viewer.
1. Expand **Windows Logs** > **System**.
1. Look for the following **WinInit** event: **12: LSASS.exe was started as a protected process with level: 4**.
### Check the current status from the registry

Copilot uses AI. Check for mistakes.

1. Open the Registry Editor, or enter **RegEdit.exe** in the **Run** dialog, and then go to the **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa** registry key.
1. Look up the **RunAsPPLBoot** value, it shows the PPL Mode used for the current OS session. if for example it is set to "1" and **RunAsPPL** is 0, the UEFI variable is still active.
Comment on lines +252 to +253
Copy link

Copilot AI Feb 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The second step has a comma splice and a mid-sentence capitalization issue (...value, it shows... / if for example...). Consider splitting into clearer sentences, capitalizing If, and formatting registry names/values consistently (for example, use code formatting for HKEY_LOCAL_MACHINE\\..., RunAsPPLBoot, RunAsPPL, and numeric values).

Suggested change
1. Open the Registry Editor, or enter **RegEdit.exe** in the **Run** dialog, and then go to the **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa** registry key.
1. Look up the **RunAsPPLBoot** value, it shows the PPL Mode used for the current OS session. if for example it is set to "1" and **RunAsPPL** is 0, the UEFI variable is still active.
1. Open Registry Editor (enter `RegEdit.exe` in the **Run** dialog), and then go to the `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa` registry key.
1. Look up the `RunAsPPLBoot` value. It shows the PPL mode used for the current OS session. If, for example, it is set to `1` and `RunAsPPL` is `0`, the UEFI variable is still active.

Copilot uses AI. Check for mistakes.

## LSA and Credential Guard

LSA protection is a security feature that defends sensitive information like credentials from theft by blocking untrusted LSA code injection and process memory dumping. LSA protection runs in the background by isolating the LSA process in a container and preventing other processes, like malicious actors or apps, from accessing the feature. This isolation makes LSA protection a vital security feature, which is why it's enabled by default in Windows 11.
Expand All @@ -262,3 +268,4 @@ Starting in Windows 11 version 22H2, VBS and Credential Guard are enabled by def
- [Partner Center for Windows Hardware](/windows-hardware/drivers/dashboard/)



Comment on lines 269 to +271
Copy link

Copilot AI Feb 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There’s an extra trailing blank line added at the end of the file. Consider removing it to avoid noisy diffs.

Suggested change

Copilot uses AI. Check for mistakes.
Loading