Microsoft.Policies.LocalSecurityAuthority• Machine
Configures LSASS to run as a protected process
This policy controls the configuration under which LSASS is run. If you do not configure this policy and there is no current setting in the registry, LSA will run as protected process for all clean installed, HVCI capable, client SKUs. This configuration is not UEFI locked. This can be overridden if the policy is configured. If you configure and set this policy setting to "Disabled", LSA will not run as a protected process. If you configure and set this policy setting to "EnabledWithUEFILock," LSA will run as a protected process and this configuration is UEFI locked. If you configure and set this policy setting to "EnabledWithoutUEFILock", LSA will run as a protected process and this configuration is not UEFI locked.
Policy Details
- Policy Name
- ConfigureLsaProtectedProcess
- Registry Key
- Software\Policies\Microsoft\Windows\System
- Supported On
- At least Windows 10 Version 1903
- OMA-URI (CSP)
- LocalSecurityAuthority/ConfigureLsaProtectedProcessOS Build Version:10.0.22621CSP Version:11.0Conflict Resolution:LastWriteAllowed Editions:EnterpriseEnterprise NProfessionalProfessional NEnterprise EvaluationEnterprise N EvaluationEducationEducation NEnterprise SEnterprise S NEnterprise S EvaluationEnterprise S N EvaluationPro Single LanguagePro ChinaPro WorkstationPro Workstation NPro For EducationPro For Education NEnterprisegEnterprisegnServerrdshIotenterpriseIotenterprisesCloudeditionnCloudeditionIotenterpriseskIotenterpriseseval
- Available Languages
- en-us
Configuration Elements
Configure LSA to run as a protected process
Type: enum
Allowed Values
- 0 Disabled
- 1 Enabled with UEFI Lock
- 2 Enabled without UEFI Lock