Allow Custom SSPs and APs to be loaded into LSASS
This registry value stores the state of a computer-scoped ADMX Group Policy setting.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows\System\AllowCustomSSPsAPs
This registry value stores the state of a computer-scoped ADMX Group Policy setting. It controls whether the Local Security Authority (LSA) may load custom security support providers (SSPs) and authentication packages (APs) into the Local Security Authority Subsystem Service (LSASS) process.
An SSP can add security protocols and services for authenticated connections, message integrity, or message encryption. An AP supplies additional logic for evaluating logon data and deciding whether a sign-in is permitted.
The value uses the REG_DWORD type. A value of 1 permits custom SSPs and APs to load, while 0 prevents them from loading. When the policy is not configured and the value is absent, Windows also permits them to load.
Notes
Additional effects
The setting only determines whether appropriately registered SSP/AP DLLs may load into LSASS. It does not install or register a security package and does not grant additional rights to users.
Permitted components remain subject to other system requirements. In particular, when LSASS runs as a protected process, LSA plug-ins must satisfy the applicable signing and compatibility requirements; an incompatible component can still be rejected.
Security
An allowed SSP/AP DLL executes within the LSASS process. Because LSASS handles sign-ins and enforces local security policy, defective or malicious code in such a package can interfere with authentication and security-sensitive data processed by LSASS. Blocking custom packages therefore reduces the amount of extensible code that can execute inside LSASS and narrows its attack surface.
The setting is limited to loading custom SSPs and APs into LSASS. It does not disable LSASS or Windows' built-in authentication mechanisms, nor does it remove general access rights from users.
Possible side effects
Blocking custom SSPs and APs can prevent products or system components from working when their authentication or security features depend on loading such a package into LSASS.
A documented example affects Windows Server 2025 failover clusters. The Cluster Authentication Manager operates as an SSP. If it cannot load into LSASS, the cluster cannot authenticate and the Cluster service might fail to start.
Notes
This setting is separate from the policy that configures LSASS to run as a protected process. Permitting custom SSPs and APs does not override signature checks or other loading restrictions imposed by additional LSA protection.
Microsoft documentation
Microsoft Learn: LocalSecurityAuthority Policy CSP
Microsoft Learn: Restrictions on registering and installing a security package
Microsoft Learn: Cluster service doesn't start after you apply hardening recommendations