How to Completely Disable ‘Local Security Authority (LSA) Protection’ via Group Policy in Windows 11

Local Security Authority (LSA) Protection is a critical Windows security feature designed to prevent code injection and memory scraping attacks (such as those executed by Mimikatz) against the LSASS (Local Security Authority Subsystem Service) process, which stores sensitive authentication credentials like NTLM hashes and Kerberos tickets. Under normal circumstances, LSA Protection should always be enabled. However, in highly specific, legacy enterprise environments, enabling LSA Protection can cause catastrophic compatibility issues. If a legacy identity management solution, custom Smart Card driver, or poorly coded third-party password filter relies on injecting unsigned DLLs directly into the LSASS process, LSA Protection will aggressively block them, resulting in domain authentication failures, blue screens (BSOD), or system lockouts.

This guide explains how to completely disable ‘Local Security Authority (LSA) Protection’ via Group Policy in Windows 11, providing a necessary (though highly insecure) workaround for environments completely reliant on incompatible legacy authentication plugins.

Disable LSA Protection via Group Policy

To enforce a strict block that permanently neutralizes the LSASS memory isolation globally across the OS, we must deploy an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Computer Configuration > Administrative Templates > System > Local Security Authority

5. In the right-hand pane, locate the policy named Configures LSASS to run as a protected process.
6. Double-click the policy to open its configuration window.
7. Select the radio button next to Disabled. (By explicitly disabling this policy, we instruct the Windows kernel to remove the Protected Process Light (PPL) boundary surrounding the `lsass.exe` executable, reverting it to a standard, inject-able process state).
8. Click Apply, then click OK.

Verify the Configuration Lockdown

Group Policy changes affecting the kernel’s process isolation boundaries require a full system restart to take effect.

Open Command Prompt as Administrator and run gpupdate /force, then restart the computer. To verify the restriction is active, open the Windows Security app and navigate to Device security > Core isolation details. The toggle for “Local Security Authority protection” will be locked in the “Off” position (or completely missing), and a message stating “This setting is managed by your administrator” will be displayed. Alternatively, open Event Viewer and check the System log for Event ID 12 (Source: Wininit) indicating that LSASS is running as a protected process; this event will no longer be generated. The Windows 11 workstation is now cryptographically bound to a legacy authentication state, allowing third-party DLL injection into the LSASS process.