Fix the “Local Security Authority protection is off” Error Using Registry Editor

One way to resolve the “Local Security Authority protection is off” issue is by turning on the LSA feature using Registry Editor. This method creates a couple of entries in your Windows registry, enabling LSA to fix your problem.

Making accidental changes to your registry can render your PC unstable. Make sure to follow the following steps carefully to avoid messing up your Windows registry.

1. Open Run by pressing Windows + R.
2. Type the following command in Run and press Enter:
   regedit
3. Select Yes in the User Account Control prompt.
4. Head to the following path in Registry Editor. Use the options in the left sidebar to select the directories.
   Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
5. Right-click anywhere blank on the right pane, choose New > DWORD (32-bit) Value, enter RunAsPPL as the entry name, and press Enter.

6. Create another entry using RunAsPPLBoot as the entry name.
7. Open each entry, type 2 in the Value data field, and select OK.

Use PowerShell to Enable Local Security Authority Protection

Another way to turn on LSA on your Windows PC is by using Windows PowerShell. If you don’t wish to use the Registry Editor method above, or you can’t use that method for some reason, this PowerShell method will help you out.

1. Open the Start menu on your PC, find Windows PowerShell, and select Run as Administrator.
2. Choose Yes in the User Account Control prompt.
3. Type the following commands, one at a time, and press Enter:reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL /t REG_DWORD /d 2 /f
   reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPLBoot /t REG_DWORD /d 2 /f

4. Quit the PowerShell window and reboot your PC.

Enable Local Security Authority Policy From Local Group Policy Editor

If you use Windows’ Pro edition and not the Home edition, you can utilize the Local Group Policy Editor tool to activate LSA on your machine. This method is relatively easy to use as you don’t have to create new entries in your Windows registry or run commands.

1. Open Run using Windows + R.
2. Type the following in the box and press Enter:
   gpedit.msc
3. Use the options in the left sidebar to navigate to the following path. Then, double-click the item that says Configure LSASS to run as a protected process on the right pane.
   Computer Configuration > Administrative Templates > System > Local Security Authority

4. Select Enabled on the window that opens, choose Enabled with UEFI Lock in the drop-down menu, and select Apply followed by OK.

5. Close Local Group Policy Editor and reboot your machine.

Uninstall Your Recent Windows Update

One reason a “Local Security Authority protection is off” error occurs is that your recent Windows update was faulty. Such updates can cause your PC to display random errors, including the one you’re experiencing.

You can get around that by rolling back the most recent update installed on your PC. This removes the changes made by that update on your PC.

1. Open the Start menu, find Control Panel, and open the utility.
2. Select Uninstall a program in Control Panel.
3. Choose View installed updates in the left sidebar.
4. Find the latest Windows update on the list and choose Uninstall.

5. Select Uninstall in the prompt to remove the update.
6. Reboot your PC.

You should pause your Windows updates as your system may automatically redownload and reinstall that very faulty update on your computer. You can resume your updates when Microsoft acknowledges the issue and says it’s safe to install updates on your machine.

On Windows 11

1. Open Settings by pressing Windows + I.
2. Select Windows Update in the left sidebar.
3. Choose the drop-down menu next to Pause updates and select Pause for 5 weeks.

4. You can resume your updates in the future by returning to the same Windows Update screen and selecting Resume updates.

On Windows 10

1. Launch Settings using Windows + I.
2. Select Update & Security in Settings.
3. Choose Windows Update in the left sidebar and select Advanced options on the right pane.
4. Select the drop-down menu in the Pause updates section and choose a date on the list.

5. Later, you can resume your updates by visiting the same Windows Update page and selecting Resume updates.

Ensure you’ve enabled Secure Boot on your Windows PC to resolve the “Local Security Authority protection is off” error. Having Secure Boot activated ensures your PC only loads the firmware trusted by your OEM.

The first thing to do is check if Secure Boot is already enabled on your PC. If that isn’t the case, enable the option from your BIOS settings page.

To check if Secure Boot is enabled:

1. Open Run using Windows + R.
2. Type the following command in Run and press Enter:
   msinfo32
3. Select System Summary in the left sidebar.
4. Check the value of Secure Boot State on the right. The value says On if the feature is enabled.

If Secure Boot State’s value says Off, turn on the feature from your PC’s BIOS menu as follows:

1. Turn off your PC by opening the Start menu, selecting the Power icon, and choosing Shut down.
2. Turn your PC back on by pressing the Power button.
3. When the first graphic appears on your screen, press and hold down the key that lets you enter your PC’s BIOS mode. You’ll use the F2 key on most computers.
4. Open the Security tab in BIOS, select the Secure Boot option, and turn on the Secure Boot Control option.

5. Access the Save & Exit tab and choose Save Changes and Exit.