Windows Security Bug - Local Security Authority Protection Not Registering a System Restart

Anonymous

After I uninstalled Avira Antimalware, I got an alert from Windows Security that my Local Security Authority Protection was turned off. But after I turned it on and restarted as instructed, I continue to get the same alert that my Local Security Authority Protection is turned off, even though within the same window, the toggle switch under the "Local Security Authority Protection" heading displays that it's already turned on.

Additionally, at the same time that this bug appeared, I've also started to get an old Windows bug where if I try to open File Explorer from the taskbar, the entire taskbar would crash and restart every time (though I can open File Explorer from the Start menu without issue).

Any help resolving either bug would be appreciated. Thanks.

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

I figure that is a missing reg entry RunAsPPLBoot in my case.

Create a new DWORD32 and set to 2

After reboot no longer get error.

RunAsPPL and RunAsPPLBoot.

By default they are set to 0 to enable this you need to set them to 2.

Also set group policy as enable for uefi lock only , my problem is fixed now, no need to reset windows.

In the Local Group Policy Editor window, navigate to the following path: Computer Configuration\Administrative Templates\System\Local Security Authority.

In the right panel, double-click on the ‘Configure LSASS to run as a protected process‘ policy.

In the policy settings window, select the Enabled option

Then click on the dropdown under Configure LSA to run as a protected process and select Enabled with UEFI Lock

0 comments

138 additional answers

Anonymous

2023-03-17T22:21:48+00:00

In case anyone here cares or is interested, this problem is even happening on Microsoft's *own* (virtualized) cloud PC service's (aka: "Windows 365" based) computers, and so it's *definitely* a problem on their side of things (they caused it, and they should be fixing it)......not that that was in much doubt.
Was this answer helpful?

0 comments No comments
Enric Cortés 39,445 Reputation points Volunteer Moderator

2023-03-17T19:22:12+00:00

Reboot the computer and make sure to enable TPM, Secure Boot and Virtualization in BIOS.
Was this answer helpful?

0 comments No comments
Anonymous

2023-03-17T19:15:06+00:00

I can't find any official documentation about the "RunAsPPLBoot" registry setting.

What does it actually do, and why does Local Security Authority protection report a warning when it's not enabled?
Was this answer helpful?

0 comments No comments
Anonymous

2023-03-17T19:08:05+00:00
Yes, it's a pretty widespread Windows 11 22H2 problem, but not for everyone.

Actually, it is Microsoft who must solve it by means of an update for the Windows Security Platform. But for now you can apply this setting:

Download from this link the folder that contains the application:

https://app.box.com/s/8br9g6arlce8pgxx5hmh6t1jcv4zj2s0

Create a restore point first

Unzip the downloaded ZIP file on the Desktop

Navigate to the location C:\Windows\System32\SecurityHealth to take ownership of that folder:

Properties > Security > Advanced Options > Change > Administrators

Check the "Replace owner on subcontainers and objects" box and click Apply.

In the "SecurityHealth Permissions" window select Administrators > Full Control. Apply.

Copy the "1.0.2207.20002-0" folder on the Desktop to the SecurityHealth folder

Open the folder and run the application "Microsoft.SecHealthUI_8wekyb3d8bbwe.appx" as administrator to update.

Restart the computer.

Tell us if it worked

Note: make these settings at your own risk.
nope that didn't work

here what my window defender look like the is something missing it use to be there not anymore
Was this answer helpful?

0 comments No comments