Lsass.exe audit mode

Supported on: At least Windows Server 2012 R2, Windows 8.1 or Windows RT 8.1

Registry

HKLM SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe

Value name: AuditLevel

Enabled: AuditLevel = 8

Disabled: AuditLevel = 0

Description

Enable auditing of Lsass.exe to evaluate feasibility of enabling LSA protection. For more information, see http://technet.microsoft.com/en-us/library/dn408187.aspx