One of the latest updates from Windows Update in Windows 11 appears to have caused a security issuedisabling (and preventing reactivation) one of the protection options of Windows Defender: the protection of Local Security Authority (LSA).
The Local Security Authority is one of the critical functions of the Microsoft security subsystem, taking responsibility —for example— for verify password changes and login attempts. Login data theft attacks are, with this component enabled, much more complex for potential attackers.
WINDOWS 11 GOD LEVEL 17 TRICKS and FEATURES to MASTER IT
The information has been sent to us by a user who points out the sudden rise of this problem in the Microsoft support forums:
“It seems that the problem has been circulating since the end of February and is now exploding as more updates are being released from Windows Update.”
LSA is a Windows protection mechanism that prevents unauthorized access to various parts of the system by potential attackers.
In fact, the first cases collected date even earlier, from mid-January (example). Apparently, according to some of the affected users, the update responsible for the problem would be the “Microsoft Defender Antivirus – KB5007651 (version 1.0.2302.21002-0)“.
Users are suddenly faced with a yellow warning icon superimposed on the traditional blue Defender icon in the system tray and, when consulting the reason for this warning, they find a message warning that LSA protection is disabled and the device is now vulnerable.
There is no use reactivating the relevant option in the Windows Security panel, not even if -as Windows asks us- we restart next. As one affected user warns on the Microsoft support forums:
“Even when I turn on the option and reboot, this warning is still there.”
One of the volunteer forum moderators provides a four-step solution to the problem (which has since been endorsed by Microsoft representatives in the same forum… and by grateful users who have seen their problem solved):
- Open a Notepad text file and copy and paste the following text:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
“RunAsPPL”=dword:00000002
“RunAsPPLBoot”=dword:00000002
- save the file like ‘E‘nableLSA.reg’ (not as .txt).
Appearance of the icon of a Registry file (*.reg) and content of the one proposed in the solution.
- Open the file: that will automatically introduce those changes in the Windows Registry without the need for us to manipulate it in Regedit.
- restart the computer.
Cortés himself later explains that “It is possible” that Windows will release an update that automatically corrects the error, but that “may take time”. In the meantime, we have this solution available.
We have contacted Microsoft for more details on possible future updates. We will expand this article when we have the company’s response.
Images: Own elaboration
In Genbeta | Using Microsoft Defender or installing free antivirus in Windows 10: these are the arguments in favor of the alternatives