Local Security Authority protection is off (but it's on)

Anonymous
2023-02-24T07:31:45+00:00

Hello,

The latest of fun W11 bugs has hit me.

Windows Security is telling me Local Security Authority protection is off - but actually it's on.

So I switch it off and on and restart the system but the warning is still there.

I have done this maybe 10 times but the warning is always there.

What is the fix for this?

Thanks

Windows for home | Windows 11 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Sumit 44,306 Reputation points Volunteer Moderator
2023-03-22T00:00:22+00:00

Microsoft has confirmed the issue.

https://learn.microsoft.com/en-us/windows/release-health/status-windows-11-22H2#3048msgdesc

After installing "Update for Microsoft Defender Antivirus antimalware platform - KB5007651 (Version 1.0.2302.21002)", you might receive a security notification or warning stating that "Local Security protection is off. Your device may be vulnerable." and once protections are enabled, your Windows device might persistently prompt that a restart is required. Important: This issue affects only "Update for Microsoft Defender Antivirus antimalware platform - KB5007651 (Version 1.0.2302.21002)". All other Windows updates released on March 14, 2023 for affected platforms (KB5023706 and KB5023698), do not cause this issue.

Workaround: If you have enabled Local Security Authority (LSA) protection and have restarted your device at least once, you can dismiss warning notifications and ignore any additional notifications prompting for a restart. You can verify that LSA protection is enabled by looking in Event Viewer using the information available here. Important: Currently, we do not recommend any other workaround for this issue.

Next steps: We are working on a resolution and will provide an update as soon as it is available.

Was this answer helpful?

300+ people found this answer helpful.
0 comments
Answer accepted by question author
Anonymous
2023-02-24T14:54:41+00:00

Solution 2 worked for me, however I had to search online for the location of the registry path that the post does not mention. Highly advise to backup your registry or create a restore point to be on the safe side before beginning. I tried this on my test machine running Windows 11 Pro, so I don't care if it falls apart.

Went to the registry path "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa"

I added RunAsPPLBoot as DWORD with a value of '2'

I already had RunAsPPL with a value of '2'

Rebooted and no more "This change requires you to restart your device" message.

Was this answer helpful?

100+ people found this answer helpful.
0 comments
Answer accepted by question author
Anonymous
2023-05-05T08:13:21+00:00

Microsoft now resolves this issue.

"Local Security Authority protection is off." with persistent restart

Resolved: 2023-05-03, 13:27 PT

After installing "Update for Microsoft Defender Antivirus antimalware platform - KB5007651 (Version 1.0.2302.21002)", you might receive a security notification or warning stating that "Local Security protection is off. Your device may be vulnerable." and once protections are enabled, your Windows device might persistently prompt that a restart is required. Important: This issue affects only "Update for Microsoft Defender Antivirus antimalware platform - KB5007651 (Version 1.0.2302.21002)". All other Windows updates released on March 14, 2023 for affected platforms (KB5023706 and KB5023698), do not cause this issue.

Resolution: This issue was resolved in an update for Microsoft Defender Antivirus antimalware platform KB5007651 (Version 1.0.2303.27001). If you would like to install the update before it is installed automatically, you will need to check for updates.

Affected platforms:

Client: Windows 11, version 22H2; Windows 11, version 21H2

Server: None

Was this answer helpful?

1 person found this answer helpful.
0 comments

197 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2023-07-08T02:51:12+00:00

    Went to the registry path "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa"

    I added RunAsPPLBoot as DWORD with a value of '2'

    I already had RunAsPPL with a value of '2'

    Rebooted and no more "This change requires you to restart your device" message.

    Thanks @JaimeVaquera worked for me!

    Was this answer helpful?

    0 comments