Configures LSASS to run as a protected process

Supported on: At least Windows 10 Version 1903

Registry

HKLM Software\Policies\Microsoft\Windows\System

Options

RunAsPPL enum
  • Disabled -> 0
  • Enabled with UEFI Lock -> 1
  • Enabled without UEFI Lock -> 2

Description

This policy controls the configuration under which LSASS is run. If you do not configure this policy and there is no current setting in the registry, LSA will run as protected process for all clean installed, HVCI capable, client SKUs. This configuration is not UEFI locked. This can be overridden if the policy is configured. If you configure and set this policy setting to "Disabled", LSA will not run as a protected process. If you configure and set this policy setting to "EnabledWithUEFILock," LSA will run as a protected process and this configuration is UEFI locked. If you configure and set this policy setting to "EnabledWithoutUEFILock", LSA will run as a protected process and this configuration is not UEFI locked.