Enable LSA Protection and Credential Guard in Windows 11

The Problem

When you sign in to Windows, the Local Security Authority process (lsass.exe) holds the material that proves who you are — password hashes, Kerberos tickets, cached domain credentials. Every credential-dumping tool in existence, from Mimikatz onwards, works by reading that process's memory.

Two Windows features close that door:

LSA protection (RunAsPPL) marks lsass.exe as a protected process, so even code running as administrator cannot read or inject into it.
Credential Guard goes further, moving the secrets into a hardware-isolated virtual container that the main Windows kernel cannot reach at all.

LSA protection works on Windows 11 Home, Pro, and Enterprise. Credential Guard needs Pro or above. On recent Windows 11 builds LSA protection is enabled by default on clean installs — but not on upgraded machines, which is most of them.

Passwords already stolen? Harden after cleanup, not before. Work through remove virus and malware, then check if your email was in a data breach and change what was exposed.

Before You Start

Both features can break software that legitimately hooks into lsass.exe: some fingerprint reader drivers, older smart-card middleware, a few VPN clients, and enterprise single-sign-on agents. That is why creating a restore point first is not optional here — if a sign-in method stops working, you want a quick way back.

Know your recovery path before you change credential settings. If BitLocker is on, make sure you can reach your recovery key: where to find your BitLocker recovery key.

The Fix: Step-by-Step

Step 1: Check Whether LSA Protection Is Already On

Open Terminal (Admin) and run:

Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | Select-Object -ExpandProperty SecurityServicesRunning

Or check the event log directly — Win + R → eventvwr.msc → Windows Logs → System, filter for source Wininit, event ID 12: "LSASS.exe was started as a protected process with level: 4" means it is already on.

The simplest check is in Windows Security: Device security → Core isolation details. Recent builds show a Local Security Authority protection toggle there.

Step 2: Turn On LSA Protection From Windows Security

If the toggle is present:

Windows + I → Privacy & security → Windows Security → Device security → Core isolation details.
Switch Local Security Authority protection to On.
Restart.

Some builds show a known cosmetic bug where the toggle warns "protection is off" after a restart despite the event log confirming it is running. Trust event ID 12, not the toggle.

Step 3: Enable It via Registry If the Toggle Is Missing

On builds without the toggle, set it directly. In Terminal (Admin):

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL /t REG_DWORD /d 2 /f

A value of 2 enables protection without UEFI lock, which is what you want on a home PC — it means you can undo the change by setting the value back to 0 and restarting. A value of 1 writes the setting into UEFI firmware and needs a Microsoft-supplied removal tool to reverse. Use 2.

Restart, then confirm with event ID 12 as above.

Step 4: Turn On Credential Guard (Pro, Enterprise, Education)

Credential Guard requires virtualisation-based security, which means the same prerequisites as Memory Integrity: virtualisation enabled in firmware, Secure Boot on, and TPM present.

Win + R → gpedit.msc.
Computer Configuration → Administrative Templates → System → Device Guard.
Open Turn On Virtualization Based Security → Enabled.
Set Credential Guard Configuration to Enabled without lock.
Set Secure Boot (or Secure Boot and DMA Protection on a laptop with Thunderbolt) as the platform security level.
Restart.

Verify with msinfo32 → System Summary → Virtualization-based security Services Running should list Credential Guard.

On Windows 11 Home, gpedit.msc does not exist. LSA protection from Step 3 is the equivalent protection available to you, and it covers the common attack.

Step 5: Clear Out Stored Credentials You Do Not Need

Hardening the vault helps less if it is full of things that should not be there.

Win + R → control /name Microsoft.CredentialManager.
Review Windows Credentials and Generic Credentials.
Remove saved credentials for machines, shares, and services you no longer use — old work file servers and stale RDP targets are the usual finds.

If any of those are passwords you reuse elsewhere, change them and move to a password manager: use a password manager safely.

Step 6: Stop Storing the Ones That Do Not Need Storing

Browser-saved passwords sit outside LSA entirely and are a separate, easier target. Move them into a dedicated manager and clear the browser store — the export/import path is in use a password manager safely. Then move the accounts that support it to passkeys, which have no shared secret to steal.

Step 7: Check What Broke

Sign out and back in. Test in this order: Windows Hello face or fingerprint, any VPN client, smart-card or certificate sign-in, and network shares.

If Windows Hello stopped working, that is the most common casualty — see Windows Hello not working and Windows Hello PIN not available.

To roll LSA protection back: set RunAsPPL to 0 and restart. This only works because you used value 2 in Step 3.

LSA Protection vs Credential Guard

| | LSA protection | Credential Guard | |---|---|---| | Editions | Home, Pro, Enterprise | Pro, Enterprise, Education | | Needs virtualisation | No | Yes | | Protects against | Reading lsass memory from admin code | The same, plus kernel-level access | | Typical breakage | Fingerprint / smart-card middleware | The above plus some VPN and SSO agents |

What Not to Do

Do not set RunAsPPL to 1 unless you specifically want the UEFI lock and understand that reversing it needs a separate Microsoft tool.
Do not disable LSA protection because one app complained. Update that app first — most vendors fixed compatibility years ago.
Do not run day to day as administrator and assume these settings cover you. They protect stored credentials; they do not stop you from typing a password into a phishing page. See spot and avoid phishing emails.

FAQ

Does LSA protection slow anything down?

No. It changes the access rules on one process. There is no scanning, no extra work per operation, and no measurable performance cost.

I enabled it but Windows Security still says it is off — is it working?

Check the System event log for Wininit event ID 12 stating LSASS started as a protected process. That entry is authoritative. A stale toggle in Windows Security after a restart is a known display issue on several builds and does not mean the protection failed.

Is Credential Guard useful on a home PC that is not on a domain?

Less so. Its biggest win is protecting domain credentials and Kerberos tickets, which a standalone home PC does not hold. LSA protection is the setting that matters at home; Credential Guard is worth enabling if the machine connects to a work domain or you use it for administrative work.

Will this stop malware stealing my browser passwords?

No. Browser password stores are separate files encrypted with your user profile key, and infostealer malware targets them directly. LSA protection covers Windows credentials only. Moving to a password manager with its own master password, and to passkeys where offered, is what addresses the browser side.

Can I enable Credential Guard on Windows 11 Home?

No — the policy and the underlying feature are not available on Home. Enable LSA protection instead, which is available on every edition and blocks the same common credential-dumping technique.

Why do I need Secure Boot for Credential Guard?

Credential Guard's isolation depends on the hypervisor being trustworthy, and Secure Boot is what guarantees nothing tampered with the boot chain before the hypervisor started. Without it the isolation could be bypassed before Windows even loads. See enable TPM and Secure Boot.

Still Not Working?

If a critical sign-in method breaks and you cannot get in, boot into recovery and use a restore point, or use Safe Mode to set RunAsPPL back to 0. If Credential Guard refuses to start, the cause is nearly always a missing prerequisite — check msinfo32 for what virtualisation-based security reports as unavailable.