Local Security Authority protection is off (but it's on)

Anonymous
2023-02-24T07:31:45+00:00

Hello,

The latest of fun W11 bugs has hit me.

Windows Security is telling me Local Security Authority protection is off - but actually it's on.

So I switch it off and on and restart the system but the warning is still there.

I have done this maybe 10 times but the warning is always there.

What is the fix for this?

Thanks

Windows for home | Windows 11 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Sumit 44,306 Reputation points Volunteer Moderator
2023-03-22T00:00:22+00:00

Microsoft has confirmed the issue.

https://learn.microsoft.com/en-us/windows/release-health/status-windows-11-22H2#3048msgdesc

After installing "Update for Microsoft Defender Antivirus antimalware platform - KB5007651 (Version 1.0.2302.21002)", you might receive a security notification or warning stating that "Local Security protection is off. Your device may be vulnerable." and once protections are enabled, your Windows device might persistently prompt that a restart is required. Important: This issue affects only "Update for Microsoft Defender Antivirus antimalware platform - KB5007651 (Version 1.0.2302.21002)". All other Windows updates released on March 14, 2023 for affected platforms (KB5023706 and KB5023698), do not cause this issue.

Workaround: If you have enabled Local Security Authority (LSA) protection and have restarted your device at least once, you can dismiss warning notifications and ignore any additional notifications prompting for a restart. You can verify that LSA protection is enabled by looking in Event Viewer using the information available here. Important: Currently, we do not recommend any other workaround for this issue.

Next steps: We are working on a resolution and will provide an update as soon as it is available.

Was this answer helpful?

300+ people found this answer helpful.
0 comments
Answer accepted by question author
Anonymous
2023-02-24T14:54:41+00:00

Solution 2 worked for me, however I had to search online for the location of the registry path that the post does not mention. Highly advise to backup your registry or create a restore point to be on the safe side before beginning. I tried this on my test machine running Windows 11 Pro, so I don't care if it falls apart.

Went to the registry path "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa"

I added RunAsPPLBoot as DWORD with a value of '2'

I already had RunAsPPL with a value of '2'

Rebooted and no more "This change requires you to restart your device" message.

Was this answer helpful?

100+ people found this answer helpful.
0 comments
Answer accepted by question author
Anonymous
2023-05-05T08:13:21+00:00

Microsoft now resolves this issue.

"Local Security Authority protection is off." with persistent restart

Resolved: 2023-05-03, 13:27 PT

After installing "Update for Microsoft Defender Antivirus antimalware platform - KB5007651 (Version 1.0.2302.21002)", you might receive a security notification or warning stating that "Local Security protection is off. Your device may be vulnerable." and once protections are enabled, your Windows device might persistently prompt that a restart is required. Important: This issue affects only "Update for Microsoft Defender Antivirus antimalware platform - KB5007651 (Version 1.0.2302.21002)". All other Windows updates released on March 14, 2023 for affected platforms (KB5023706 and KB5023698), do not cause this issue.

Resolution: This issue was resolved in an update for Microsoft Defender Antivirus antimalware platform KB5007651 (Version 1.0.2303.27001). If you would like to install the update before it is installed automatically, you will need to check for updates.

Affected platforms:

Client: Windows 11, version 22H2; Windows 11, version 21H2

Server: None

Was this answer helpful?

1 person found this answer helpful.
0 comments

197 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2023-02-27T23:28:14+00:00

    I have the same problem... LSA Protection is enabled, but I am getting the alert that it is off. I don't want to dismiss this alert.

    It seems to be related to KB5022845, installed about 2 weeks ago.

    Was this answer helpful?

    10+ people found this answer helpful.
    0 comments
  2. Anonymous
    2023-02-24T20:54:23+00:00

    Nine people in that thread I linked said the problem was solved by the suggestion marked as Answer.

    Also did you do the disinfection procedure? You need to know first this is not caused by an attack and those scanners are the best available to test this. This is the level of thoroughness required here, dismissing it without even reporting back a single result is reckless.

    This is an interactive process. I give steps to perform, you do each one and then report back results until something works, so I know what to suggest next. If you need help performing any step, just ask back. But please do not skip any steps. We often find out the skipped step is the fix.

    Was this answer helpful?

    5 people found this answer helpful.
    0 comments