Local Security Authority protection is off (but it's on)

Anonymous
2023-02-24T07:31:45+00:00

Hello,

The latest of fun W11 bugs has hit me.

Windows Security is telling me Local Security Authority protection is off - but actually it's on.

So I switch it off and on and restart the system but the warning is still there.

I have done this maybe 10 times but the warning is always there.

What is the fix for this?

Thanks

Windows for home | Windows 11 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Sumit 44,306 Reputation points Volunteer Moderator
2023-03-22T00:00:22+00:00

Microsoft has confirmed the issue.

https://learn.microsoft.com/en-us/windows/release-health/status-windows-11-22H2#3048msgdesc

After installing "Update for Microsoft Defender Antivirus antimalware platform - KB5007651 (Version 1.0.2302.21002)", you might receive a security notification or warning stating that "Local Security protection is off. Your device may be vulnerable." and once protections are enabled, your Windows device might persistently prompt that a restart is required. Important: This issue affects only "Update for Microsoft Defender Antivirus antimalware platform - KB5007651 (Version 1.0.2302.21002)". All other Windows updates released on March 14, 2023 for affected platforms (KB5023706 and KB5023698), do not cause this issue.

Workaround: If you have enabled Local Security Authority (LSA) protection and have restarted your device at least once, you can dismiss warning notifications and ignore any additional notifications prompting for a restart. You can verify that LSA protection is enabled by looking in Event Viewer using the information available here. Important: Currently, we do not recommend any other workaround for this issue.

Next steps: We are working on a resolution and will provide an update as soon as it is available.

Was this answer helpful?

300+ people found this answer helpful.
0 comments
Answer accepted by question author
Anonymous
2023-02-24T14:54:41+00:00

Solution 2 worked for me, however I had to search online for the location of the registry path that the post does not mention. Highly advise to backup your registry or create a restore point to be on the safe side before beginning. I tried this on my test machine running Windows 11 Pro, so I don't care if it falls apart.

Went to the registry path "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa"

I added RunAsPPLBoot as DWORD with a value of '2'

I already had RunAsPPL with a value of '2'

Rebooted and no more "This change requires you to restart your device" message.

Was this answer helpful?

100+ people found this answer helpful.
0 comments
Answer accepted by question author
Anonymous
2023-05-05T08:13:21+00:00

Microsoft now resolves this issue.

"Local Security Authority protection is off." with persistent restart

Resolved: 2023-05-03, 13:27 PT

After installing "Update for Microsoft Defender Antivirus antimalware platform - KB5007651 (Version 1.0.2302.21002)", you might receive a security notification or warning stating that "Local Security protection is off. Your device may be vulnerable." and once protections are enabled, your Windows device might persistently prompt that a restart is required. Important: This issue affects only "Update for Microsoft Defender Antivirus antimalware platform - KB5007651 (Version 1.0.2302.21002)". All other Windows updates released on March 14, 2023 for affected platforms (KB5023706 and KB5023698), do not cause this issue.

Resolution: This issue was resolved in an update for Microsoft Defender Antivirus antimalware platform KB5007651 (Version 1.0.2303.27001). If you would like to install the update before it is installed automatically, you will need to check for updates.

Affected platforms:

Client: Windows 11, version 22H2; Windows 11, version 21H2

Server: None

Was this answer helpful?

1 person found this answer helpful.
0 comments

197 additional answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Anonymous
    2023-05-24T13:09:04+00:00

    I am beginning to think that we have a clash here between Windows 11 Home and Windows 11 Professional (or whatever it is called). Windows Home users should not be being told to examine an Event Log or change the Registry. There appears to be a specific problem in Windows Home where it reports the LSA problem and provides a link to the Settings page where we are supposed to switch LSA on but in Windows Home there is no such option. I am a tech expert and I have examined my Event Log and there are no LSA messages. I have checked my Services and the service is running. I have checked my Processes and the exe is running. I do not know if this means that LSA is running but in the wrong mode or if everything is fine. Microsoft need to sort this out separately from whatever the original problem was. It may be that in fixing Windows Professional, they broke Windows Home or it may be that a different fix is needed for Windows Home or this may all be just a coincidence. Will other posters please acknowledge there appears to be two different presentations of this problem and stop telling us Home users to use the Professional fix/workaround. We want Microsoft to stop telling us to change a setting that does not exist!

    Was this answer helpful?

    0 comments
  2. Anonymous
    2023-05-24T14:50:50+00:00

    Exactly, I am unable to find the option where I will turn on LSA ...

    Was this answer helpful?

    0 comments