Enable LSA Protection (RunAsPPL) on Windows

Protect saved Windows credentials from theft by running LSASS as a protected process.

WindowsregistryhardeningsecurityMedium risk

Run `reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL /t REG_DWORD /d 2 /f` in an admin terminal, then restart the PC.

01Command

Command

$ reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL /t REG_DWORD /d 2 /f

02What it does

The Local Security Authority (LSASS) holds your Windows logon credentials in memory, which is exactly what password-stealing malware targets. LSA protection runs LSASS as a 'protected process' so normal programs cannot read it or inject code into it. Setting RunAsPPL to 2 turns protection on via registry alone (no UEFI lock), and Windows 11 clean installs already have it enabled — older upgraded PCs often do not.

03Risk

RiskMedium risk

Requirements需要管理员权限；Windows 11 22H2 / Windows 11 新装机默认已开启；某些旧驱动（如老版本安全软件）可能不兼容，需重启生效。

!Warning: This needs admin rights and a restart. Very old security or input drivers may fail to load with protection on; if Windows won't start normally, boot Safe Mode and set RunAsPPL back to 0.

04Undo

Undo

$ reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL /t REG_DWORD /d 0 /f

05Sources

Configuring Additional LSA Protection | Microsoft Learn
Microsoft · vendor-doc · 2026-09-17
Evidence: RunAsPPL=2 enables LSA protection without UEFI variable; the LSASS process runs as protected process preventing code injection and credential dumping.

Last verified: 2026-09-18 · Category: Security & Privacy

06Related solutions

Fix 'scripts is disabled on this system' with Set-ExecutionPolicy

WindowsTerminaldevelopersecurity

Understand PowerShell's execution policy scopes and set the one that lets you run your own local scripts without gutting the security model.

Medium risk ✓ 2026-09-17

Take ownership of a file or folder with takeown and icacls

WindowsFilessystemsecurity

Two-step command sequence that makes you the owner of a locked file tree and grants yourself full control — the standard fix for 'Access is denied' on old profiles and OS reinstall leftovers.

High risk ✓ 2026-09-17

Verify File Hashes with certutil -hashfile

Windowshashcmdsecurity

Built-in Windows command to compute MD5, SHA1 or SHA-256 hashes of any file.

Low risk ✓ 2026-09-17