You Open Windows Security and See a Red Warning About “Protection Being Off”
Windows Security shows a red banner: “Local Security Authority protection is off. Your device may be vulnerable.” It sounds serious – LSA is the process that guards your login credentials – and the instinct is to panic and immediately try to turn it back on. Before you do anything else, there’s something worth knowing: this warning is frequently wrong.
Microsoft has acknowledged that Windows Security’s own interface sometimes fails to correctly detect whether LSA protection is actually enabled. The setting can genuinely be on, doing its job, while the UI reports it as off – a display bug, not a real security gap. That doesn’t mean you should ignore it outright, but it does mean the first step isn’t a fix – it’s a check.
Local Security Authority Protection Is Off – Check If It’s Real
Open the Registry Editor (search “regedit” in the Start menu) and navigate to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
Look for a value called RunAsPPL. If it’s set to 1, LSA protection is genuinely enabled at the system level, regardless of what the Windows Security app is telling you. If that value is missing or set to 0, the protection really is off, and the steps below apply to you.
Turning It Back On Properly
If the registry check confirms it’s actually off, the cleanest way to re-enable it depends on your Windows edition. On Windows 11 22H2 and later, Group Policy gives you a dedicated toggle: open gpedit.msc, go to Computer Configuration > Administrative Templates > System > Local Security Authority, and enable the LSA protection policy there. This is more reliable than editing the registry key directly, since it handles the related settings Windows expects to see together.
If you don’t have Group Policy Editor (common on Home editions), you can set the registry value directly – back up the registry first, then create or edit the RunAsPPL DWORD value under the path above and set it to 1. A restart is required either way for the change to take effect.
What Usually Triggers the False Warning
A few specific situations tend to produce this warning even when nothing is actually wrong: right after installing a Windows update, especially a feature update; after disabling and re-enabling Secure Boot; and on systems where a driver hasn’t been properly signed and Windows flags the broader security chain as a result. In most of these cases, installing the latest cumulative update resolves the display issue without you touching the registry at all – Microsoft has shipped several patches specifically targeting this false positive.
If you’ve confirmed through the registry that protection is genuinely active, and updating Windows doesn’t clear the warning, running sfc /scannow from an administrator Command Prompt is worth trying next – a corrupted system file can occasionally cause the Security app to misreport its own settings.
When to Actually Worry
Not every “Local Security Authority protection is off” warning is harmless, though – take it seriously if the registry check shows LSA protection is genuinely off and you didn’t turn it off yourself – particularly if this coincided with installing unfamiliar software, downloading a driver from outside the manufacturer’s official site, or any other change you don’t fully trust. In that specific scenario, re-enable protection through the steps above and consider a full malware scan before assuming it’s just a display glitch.
For most people who see this warning out of nowhere with no recent unusual activity, though, it’s the known false-positive bug – and a Windows Update check is the first thing worth trying, not a registry edit. If you’re also dealing with other post-update shell glitches, our File Explorer freezing fix guide covers a similar category of Windows Update side effects.
Tested on: Windows 11 23H2 · Windows 11 24H2 · Windows 11 25H2 – Updated August 2026
Tags: local security authority protection is off windows 11 fix, LSA protection warning false positive windows 11, RunAsPPL registry value windows 11 security
