# Enable LSA Protection and Credential Guard in Windows 11

URL: https://www.mytechnician.tech/tips/enable-lsa-protection-credential-guard-windows-11/
Published: 2026-08-07 | Author: Ankit Kumar
Tags: Windows 11, Security, Password, Privacy
Summary: Stop password-stealing tools reading saved credentials out of memory. Turn on LSA protection on any Windows 11 PC, and Credential Guard on Pro and Enterprise.

## The Problem
When you sign in to Windows, the **Local Security Authority** process (`lsass.exe`) holds the material that proves who you are — password hashes, Kerberos tickets, cached domain credentials. Every credential-dumping tool in existence, from Mimikatz onwards, works by reading that process's memory.

Two Windows features close that door:

* **LSA protection** (RunAsPPL) marks `lsass.exe` as a protected process, so even code running as administrator cannot read or inject into it.
* **Credential Guard** goes further, moving the secrets into a hardware-isolated virtual container that the main Windows kernel cannot reach at all.

LSA protection works on Windows 11 Home, Pro, and Enterprise. Credential Guard needs Pro or above. On recent Windows 11 builds LSA protection is enabled by default on clean installs — but not on upgraded machines, which is most of them.

> **Passwords already stolen?** Harden after cleanup, not before. Work through [remove virus and malware](https://www.mytechnician.tech/tips/remove-virus-malware-windows-11/), then [check if your email was in a data breach](https://www.mytechnician.tech/tips/check-if-your-email-was-in-a-data-breach/) and change what was exposed.

## Before You Start
Both features can break software that legitimately hooks into `lsass.exe`: some fingerprint reader drivers, older smart-card middleware, a few VPN clients, and enterprise single-sign-on agents. That is why [creating a restore point](https://www.mytechnician.tech/tips/create-system-restore-point-windows-11/) first is not optional here — if a sign-in method stops working, you want a quick way back.

Know your recovery path before you change credential settings. If BitLocker is on, make sure you can reach your recovery key: [where to find your BitLocker recovery key](https://www.mytechnician.tech/tips/fix-bitlocker-recovery-key-loop-windows-11/).

## The Fix: Step-by-Step

### Step 1: Check Whether LSA Protection Is Already On
Open **Terminal (Admin)** and run:

```
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | Select-Object -ExpandProperty SecurityServicesRunning
```

Or check the event log directly — `Win + R` → `eventvwr.msc` → **Windows Logs** → **System**, filter for source **Wininit**, event ID **12**: *"LSASS.exe was started as a protected process with level: 4"* means it is already on.

The simplest check is in Windows Security: **Device security** → **Core isolation details**. Recent builds show a **Local Security Authority protection** toggle there.

### Step 2: Turn On LSA Protection From Windows Security
If the toggle is present:

1. `Windows + I` → **Privacy & security** → **Windows Security** → **Device security** → **Core isolation details**.
2. Switch **Local Security Authority protection** to **On**.
3. Restart.

Some builds show a known cosmetic bug where the toggle warns *"protection is off"* after a restart despite the event log confirming it is running. Trust event ID 12, not the toggle.

### Step 3: Enable It via Registry If the Toggle Is Missing
On builds without the toggle, set it directly. In **Terminal (Admin)**:

```
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL /t REG_DWORD /d 2 /f
```

A value of `2` enables protection *without* UEFI lock, which is what you want on a home PC — it means you can undo the change by setting the value back to `0` and restarting. A value of `1` writes the setting into UEFI firmware and needs a Microsoft-supplied removal tool to reverse. **Use 2.**

Restart, then confirm with event ID 12 as above.

### Step 4: Turn On Credential Guard (Pro, Enterprise, Education)
Credential Guard requires virtualisation-based security, which means the same prerequisites as [Memory Integrity](https://www.mytechnician.tech/tips/enable-core-isolation-memory-integrity-windows-11/): virtualisation enabled in firmware, Secure Boot on, and TPM present.

1. `Win + R` → `gpedit.msc`.
2. **Computer Configuration** → **Administrative Templates** → **System** → **Device Guard**.
3. Open **Turn On Virtualization Based Security** → **Enabled**.
4. Set **Credential Guard Configuration** to **Enabled without lock**.
5. Set **Secure Boot** (or **Secure Boot and DMA Protection** on a laptop with Thunderbolt) as the platform security level.
6. Restart.

Verify with `msinfo32` → **System Summary** → **Virtualization-based security Services Running** should list *Credential Guard*.

On Windows 11 Home, `gpedit.msc` does not exist. LSA protection from Step 3 is the equivalent protection available to you, and it covers the common attack.

### Step 5: Clear Out Stored Credentials You Do Not Need
Hardening the vault helps less if it is full of things that should not be there.

1. `Win + R` → `control /name Microsoft.CredentialManager`.
2. Review **Windows Credentials** and **Generic Credentials**.
3. Remove saved credentials for machines, shares, and services you no longer use — old work file servers and stale RDP targets are the usual finds.

If any of those are passwords you reuse elsewhere, change them and move to a password manager: [use a password manager safely](https://www.mytechnician.tech/tips/use-a-password-manager-safely/).

### Step 6: Stop Storing the Ones That Do Not Need Storing
Browser-saved passwords sit outside LSA entirely and are a separate, easier target. Move them into a dedicated manager and clear the browser store — the export/import path is in [use a password manager safely](https://www.mytechnician.tech/tips/use-a-password-manager-safely/). Then move the accounts that support it to [passkeys](https://www.mytechnician.tech/tips/set-up-passkeys-passwordless-sign-in/), which have no shared secret to steal.

### Step 7: Check What Broke
Sign out and back in. Test in this order: Windows Hello face or fingerprint, any VPN client, smart-card or certificate sign-in, and network shares.

If Windows Hello stopped working, that is the most common casualty — see [Windows Hello not working](https://www.mytechnician.tech/tips/fix-windows-hello-not-working/) and [Windows Hello PIN not available](https://www.mytechnician.tech/tips/fix-windows-hello-pin-not-available-windows-11/).

To roll LSA protection back: set `RunAsPPL` to `0` and restart. This only works because you used value `2` in Step 3.

## LSA Protection vs Credential Guard

| | LSA protection | Credential Guard |
|---|---|---|
| Editions | Home, Pro, Enterprise | Pro, Enterprise, Education |
| Needs virtualisation | No | Yes |
| Protects against | Reading `lsass` memory from admin code | The same, plus kernel-level access |
| Typical breakage | Fingerprint / smart-card middleware | The above plus some VPN and SSO agents |

## What Not to Do
* **Do not set `RunAsPPL` to `1`** unless you specifically want the UEFI lock and understand that reversing it needs a separate Microsoft tool.
* **Do not disable LSA protection** because one app complained. Update that app first — most vendors fixed compatibility years ago.
* **Do not run day to day as administrator** and assume these settings cover you. They protect stored credentials; they do not stop you from typing a password into a phishing page. See [spot and avoid phishing emails](https://www.mytechnician.tech/tips/spot-avoid-phishing-emails-scams/).

## FAQ

### Does LSA protection slow anything down?
No. It changes the access rules on one process. There is no scanning, no extra work per operation, and no measurable performance cost.

### I enabled it but Windows Security still says it is off — is it working?
Check the System event log for Wininit event ID 12 stating LSASS started as a protected process. That entry is authoritative. A stale toggle in Windows Security after a restart is a known display issue on several builds and does not mean the protection failed.

### Is Credential Guard useful on a home PC that is not on a domain?
Less so. Its biggest win is protecting domain credentials and Kerberos tickets, which a standalone home PC does not hold. LSA protection is the setting that matters at home; Credential Guard is worth enabling if the machine connects to a work domain or you use it for administrative work.

### Will this stop malware stealing my browser passwords?
No. Browser password stores are separate files encrypted with your user profile key, and infostealer malware targets them directly. LSA protection covers Windows credentials only. Moving to a password manager with its own master password, and to passkeys where offered, is what addresses the browser side.

### Can I enable Credential Guard on Windows 11 Home?
No — the policy and the underlying feature are not available on Home. Enable LSA protection instead, which is available on every edition and blocks the same common credential-dumping technique.

### Why do I need Secure Boot for Credential Guard?
Credential Guard's isolation depends on the hypervisor being trustworthy, and Secure Boot is what guarantees nothing tampered with the boot chain before the hypervisor started. Without it the isolation could be bypassed before Windows even loads. See [enable TPM and Secure Boot](https://www.mytechnician.tech/tips/enable-tpm-secure-boot-windows-11-upgrade/).

## Still Not Working?
If a critical sign-in method breaks and you cannot get in, boot into recovery and use a restore point, or use [Safe Mode](https://www.mytechnician.tech/tips/how-to-enter-safe-mode-windows-11/) to set `RunAsPPL` back to `0`. If Credential Guard refuses to start, the cause is nearly always a missing prerequisite — check `msinfo32` for what virtualisation-based security reports as unavailable.

Related: [enable Core Isolation and Memory Integrity](https://www.mytechnician.tech/tips/enable-core-isolation-memory-integrity-windows-11/), [set up passkeys](https://www.mytechnician.tech/tips/set-up-passkeys-passwordless-sign-in/), [review and revoke app access and active sessions](https://www.mytechnician.tech/tips/review-revoke-app-access-active-sessions/).

---
Source: https://www.mytechnician.tech/tips/enable-lsa-protection-credential-guard-windows-11/ — My Technician, free Windows 10/11 troubleshooting guides.
More guides: https://www.mytechnician.tech/llms.txt