Local Security Authority protection at boot
Microsoft does not publish a technical reference that assigns an independent, supported meaning to `RunAsPPLBoot` with data `1`.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPLBoot
Microsoft does not publish a technical reference that assigns an independent, supported meaning to RunAsPPLBoot with data 1. In particular, the official documentation does not establish that this value by itself enables Local Security Authority (LSA) protection or starts LSASS.exe as a protected process.
The registry value Microsoft documents for this feature is RunAsPPL. When LSA protection is actually enabled, LSASS.exe runs as a protected process. This restricts nonprotected processes from reading LSA memory or injecting code into the process.
Notes
Security
The presence of RunAsPPLBoot with data 1 is not a Microsoft-documented indication that LSA protection is effective. This value alone therefore does not provide reliable evidence that stored credentials are protected against memory access or code injection.
When enabled through a supported configuration, LSA protection makes it more difficult to steal credentials managed by LSA. It does not replace Credential Guard or other credential-protection mechanisms.
Possible side effects
Microsoft does not document the compatibility or system effects of RunAsPPLBoot=1.
When LSA protection is genuinely active, LSA plug-ins and drivers that do not meet the applicable signing and compatibility requirements can fail to load. Examples include password filters, smart-card components, and cryptographic plug-ins. A debugger also cannot be attached to the protected LSASS process.
Notes
RunAsPPLBoot must not be treated as equivalent to the documented RunAsPPL value. For RunAsPPL, Microsoft defines data 1 as enabling LSA protection with configuration stored in UEFI firmware and—on supported Windows 11 version 22H2 and later systems—data 2 as enabling it without a UEFI lock.
Because Microsoft documents neither the supported data values nor the applicable Windows versions for RunAsPPLBoot, the Setup Foundry catalog description “Enable LSA Protection at boot” cannot be verified for this registry value in isolation.
Microsoft documentation
Microsoft Learn: Configure added LSA protection
Microsoft Support: Device Security in the Windows Security App