[{"data":1,"prerenderedAt":295},["ShallowReactive",2],{"doku:en:richtlinien-anhang\u002Fhilfe-microsoft-policies-localsecurityauthority-configurelsaprotectedprocess":3},{"seite":4,"start":40,"leiste":41,"bereich":294,"zurueck":294,"weiter":294},{"sprache":5,"rel":6,"zu":7,"id":8,"titel":9,"titelHtml":9,"beschreibung":10,"kennzeile":11,"imMenue":12,"html":13,"ueberschriften":14},"en","richtlinien-anhang\u002Fhilfe-microsoft-policies-localsecurityauthority-configurelsaprotectedprocess","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-microsoft-policies-localsecurityauthority-configurelsaprotectedprocess","referenz-hilfe-microsoft-policies-localsecurityauthority-configurelsaprotectedprocess","Configures LSASS to run as a protected process","The `RunAsPPL` registry value controls whether the Local Security Authority process (`LSASS.exe`) runs with added LSA protection as a Protected Process Light (PPL).","since 0.9.8.11",false,"\u003Ch2 id=\"purpose\">Purpose\u003C\u002Fh2>\n\u003Cdetails class=\"doku-klappbox\">\u003Csummary>Show registry keys (1)\u003C\u002Fsummary>\u003Cdiv class=\"doku-klappbox-inhalt\">\n\u003Cul>\n\u003Cli>\u003Ccode>HKLM\\System\\CurrentControlSet\\Control\\Lsa\\RunAsPPL\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fdiv>\u003C\u002Fdetails>\n\u003Cp>The \u003Ccode>RunAsPPL\u003C\u002Fcode> registry value controls whether the Local Security Authority process (\u003Ccode>LSASS.exe\u003C\u002Fcode>) runs with added LSA protection as a Protected Process Light (PPL). LSASS performs functions that include validating local and remote sign-ins, enforcing local security policy, and managing credentials used for authentication.\u003C\u002Fp>\n\u003Cp>The value uses the \u003Ccode>REG_DWORD\u003C\u002Fcode> data type. Microsoft documents these value data:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ccode>1\u003C\u002Fcode>: Enables LSA protection and, on capable systems, stores the configuration in a UEFI firmware variable.\u003C\u002Fli>\n\u003Cli>\u003Ccode>2\u003C\u002Fcode>: Enables LSA protection without a UEFI lock. This value is enforced only on Windows 11, version 22H2 and later.\u003C\u002Fli>\n\u003Cli>\u003Ccode>0\u003C\u002Fcode>: Disables LSA protection controlled through this registry value, provided that an existing UEFI lock does not remain in effect.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>A change takes effect at the next system startup.\u003C\u002Fp>\n\u003Ch2 id=\"notes\">Notes\u003C\u002Fh2>\n\u003Ch3 id=\"additional-effects\">Additional effects\u003C\u002Fh3>\n\u003Cp>When protection is enabled with a UEFI lock on a device with suitable UEFI and Secure Boot support, the configuration is persisted in firmware. Later registry or policy changes cannot remove that firmware setting. On devices without usable UEFI or Secure Boot support, protection instead depends on the registry configuration alone.\u003C\u002Fp>\n\u003Cp>LSA protection and Windows Defender Credential Guard are complementary but separate security features. \u003Ccode>RunAsPPL\u003C\u002Fcode> does not by itself enable the VBS-based secret isolation provided by Credential Guard.\u003C\u002Fp>\n\u003Ch3 id=\"security\">Security\u003C\u002Fh3>\n\u003Cp>Running LSASS as a protected process prevents unprotected processes from performing certain memory accesses and makes untrusted code injection into LSASS more difficult. This reduces the opportunity for malware to extract credentials managed by LSASS through process-memory access or code injection.\u003C\u002Fp>\n\u003Cp>The UEFI-locked mode adds resistance to attempts to disable the protection through registry or policy changes. Without a UEFI lock, an attacker who has sufficient privileges can alter the configuration; disabling the protection takes effect after a restart.\u003C\u002Fp>\n\u003Cp>This value does not protect every credential in every circumstance and is not a replacement for Credential Guard or other controls that protect privileged accounts and authentication data.\u003C\u002Fp>\n\u003Ch3 id=\"possible-side-effects\">Possible side effects\u003C\u002Fh3>\n\u003Cp>LSA plug-ins and drivers must satisfy the signing and security requirements for protected processes. Incompatible components cannot load into LSASS. Examples can include smart card drivers, cryptographic plug-ins, password filters, and password-change notification components.\u003C\u002Fp>\n\u003Cp>A component can also be rejected if it uses disallowed shared sections or otherwise fails the protected-process requirements, even when it is signed. Authentication, smart card, or password-related functionality supplied by that component can consequently stop working. Custom LSA plug-ins also cannot be debugged by attaching a debugger to LSASS while it is running as a protected process.\u003C\u002Fp>\n\u003Ch3 id=\"notes-1\">Notes\u003C\u002Fh3>\n\u003Cp>Microsoft documents the registry-based \u003Ccode>RunAsPPL\u003C\u002Fcode> configuration for Windows 8.1 and later and Windows Server 2012 R2 and later. The non-UEFI-locked value \u003Ccode>2\u003C\u002Fcode>, however, is enforced only on Windows 11, version 22H2 and later.\u003C\u002Fp>\n\u003Cp>The ADMX policy with the same display name under “System > Local Security Authority” is a separate policy interface for Windows 11, version 22H2 and later and is mapped to the \u003Ccode>Software\\Policies\\Microsoft\\Windows\\System\u003C\u002Fcode> policy branch. It should not be treated as the same registry location as the direct \u003Ccode>RunAsPPL\u003C\u002Fcode> system value documented here.\u003C\u002Fp>\n\u003Cp>An absent \u003Ccode>RunAsPPL\u003C\u002Fcode> value does not necessarily mean that protection is disabled on a newly installed Windows 11 system. Starting with Windows 11, version 22H2, Windows can automatically enable LSA protection without a UEFI lock on eligible enterprise-joined, HVCI-capable client devices.\u003C\u002Fp>\n\u003Ch3 id=\"microsoft-documentation\">Microsoft documentation\u003C\u002Fh3>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows-server\u002Fsecurity\u002Fcredentials-protection-and-management\u002Fconfiguring-additional-lsa-protection\">Microsoft Learn: Configure added LSA protection\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-lsa#configurelsaprotectedprocess\">Microsoft Learn: LocalSecurityAuthority Policy CSP\u003C\u002Fa>\u003C\u002Fp>\n\u003Ch2 id=\"see-also\">See also\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-anmeldung-konten#e-20ebafd2eb\">Entry in the reference\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n",[15,19,22,26,29,32,34,37],{"ebene":16,"id":17,"text":18},2,"purpose","Purpose",{"ebene":16,"id":20,"text":21},"notes","Notes",{"ebene":23,"id":24,"text":25},3,"additional-effects","Additional effects",{"ebene":23,"id":27,"text":28},"security","Security",{"ebene":23,"id":30,"text":31},"possible-side-effects","Possible side effects",{"ebene":23,"id":33,"text":21},"notes-1",{"ebene":23,"id":35,"text":36},"microsoft-documentation","Microsoft documentation",{"ebene":16,"id":38,"text":39},"see-also","See also","\u002Fen\u002Fdocumentation",[42,62,74,82,130,150,166,182,206,222,238],{"titel":43,"pfad":44,"seiten":45},"Getting started","erste-schritte",[46,50,54,58],{"rel":47,"titel":48,"zu":49},"erste-schritte\u002Fwas-ist-setup-foundry","Setup Foundry","\u002Fen\u002Fdocumentation\u002Ferste-schritte\u002Fwas-ist-setup-foundry",{"rel":51,"titel":52,"zu":53},"erste-schritte\u002Finstallation","Installing Setup Foundry","\u002Fen\u002Fdocumentation\u002Ferste-schritte\u002Finstallation",{"rel":55,"titel":56,"zu":57},"erste-schritte\u002Fschnellstart","Quick start","\u002Fen\u002Fdocumentation\u002Ferste-schritte\u002Fschnellstart",{"rel":59,"titel":60,"zu":61},"erste-schritte\u002Fablauf","How it works","\u002Fen\u002Fdocumentation\u002Ferste-schritte\u002Fablauf",{"titel":63,"pfad":64,"seiten":65},"Setup","wizard",[66,70],{"rel":67,"titel":68,"zu":69},"wizard\u002Fuebersicht","The setup wizard","\u002Fen\u002Fdocumentation\u002Fwizard\u002Fuebersicht",{"rel":71,"titel":72,"zu":73},"wizard\u002Fsystemanforderungen","System requirements","\u002Fen\u002Fdocumentation\u002Fwizard\u002Fsystemanforderungen",{"titel":75,"pfad":76,"seiten":77},"Setup in detail","einrichtung-detail",[78],{"rel":79,"titel":80,"zu":81},"einrichtung-detail\u002Fwindows-quelle","Import an ISO","\u002Fen\u002Fdocumentation\u002Feinrichtung-detail\u002Fwindows-quelle",{"titel":83,"pfad":84,"seiten":85},"Foundry","konfiguration",[86,90,94,98,102,106,110,114,118,122,126],{"rel":87,"titel":88,"zu":89},"konfiguration\u002Fprofile","Profiles","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fprofile",{"rel":91,"titel":92,"zu":93},"konfiguration\u002Fquellen","Sources","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fquellen",{"rel":95,"titel":96,"zu":97},"konfiguration\u002Fbenutzer","Configuring users","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fbenutzer",{"rel":99,"titel":100,"zu":101},"konfiguration\u002Fbilder","Background picture and logo","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fbilder",{"rel":103,"titel":104,"zu":105},"konfiguration\u002Fwindows-bereinigen","Cleaning up Windows","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fwindows-bereinigen",{"rel":107,"titel":108,"zu":109},"konfiguration\u002Fapps-entfernen","Removing apps","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fapps-entfernen",{"rel":111,"titel":112,"zu":113},"konfiguration\u002Fauswaehlen","Selecting applications","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fauswaehlen",{"rel":115,"titel":116,"zu":117},"konfiguration\u002Frichtlinien","Policies","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien",{"rel":119,"titel":120,"zu":121},"konfiguration\u002Fpc-informationen","PC information","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fpc-informationen",{"rel":123,"titel":124,"zu":125},"konfiguration\u002Fnamensschema","Naming scheme","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fnamensschema",{"rel":127,"titel":128,"zu":129},"konfiguration\u002Finstall-assist-gestalten","Design the Install Assist","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Finstall-assist-gestalten",{"titel":131,"pfad":132,"seiten":133},"Installation","installationsmedien",[134,138,142,146],{"rel":135,"titel":136,"zu":137},"installationsmedien\u002Fusb-stick","Create a USB drive","\u002Fen\u002Fdocumentation\u002Finstallationsmedien\u002Fusb-stick",{"rel":139,"titel":140,"zu":141},"installationsmedien\u002Fiso-erstellen","Creating an ISO","\u002Fen\u002Fdocumentation\u002Finstallationsmedien\u002Fiso-erstellen",{"rel":143,"titel":144,"zu":145},"installationsmedien\u002Fvhd-erstellen","Create VHD","\u002Fen\u002Fdocumentation\u002Finstallationsmedien\u002Fvhd-erstellen",{"rel":147,"titel":148,"zu":149},"installationsmedien\u002Finstall-assist","Install Assist on the target computer","\u002Fen\u002Fdocumentation\u002Finstallationsmedien\u002Finstall-assist",{"titel":151,"pfad":152,"seiten":153},"Machines","pruefmaschine",[154,158,162],{"rel":155,"titel":156,"zu":157},"pruefmaschine\u002Fhyper-v-berechtigungen","Hyper-V permissions","\u002Fen\u002Fdocumentation\u002Fpruefmaschine\u002Fhyper-v-berechtigungen",{"rel":159,"titel":160,"zu":161},"pruefmaschine\u002Fverwenden","Use the test machine","\u002Fen\u002Fdocumentation\u002Fpruefmaschine\u002Fverwenden",{"rel":163,"titel":164,"zu":165},"pruefmaschine\u002Ferstellen","Create a machine","\u002Fen\u002Fdocumentation\u002Fpruefmaschine\u002Ferstellen",{"titel":167,"pfad":168,"seiten":169},"Editions","editionen",[170,174,178],{"rel":171,"titel":172,"zu":173},"editionen\u002Fvergleich","Editions at a glance","\u002Fen\u002Fdocumentation\u002Feditionen\u002Fvergleich",{"rel":175,"titel":176,"zu":177},"editionen\u002Flizenz-aktivieren","Activate a license","\u002Fen\u002Fdocumentation\u002Feditionen\u002Flizenz-aktivieren",{"rel":179,"titel":180,"zu":181},"editionen\u002Faktivierungen-zuruecksetzen","Reset activations","\u002Fen\u002Fdocumentation\u002Feditionen\u002Faktivierungen-zuruecksetzen",{"titel":183,"pfad":184,"seiten":185},"Troubleshooting","fehler",[186,190,194,198,202],{"rel":187,"titel":188,"zu":189},"fehler\u002Fusb","USB drive problems","\u002Fen\u002Fdocumentation\u002Ffehler\u002Fusb",{"rel":191,"titel":192,"zu":193},"fehler\u002Fiso","ISO import problems","\u002Fen\u002Fdocumentation\u002Ffehler\u002Fiso",{"rel":195,"titel":196,"zu":197},"fehler\u002Fhyperv","Hyper-V problems","\u002Fen\u002Fdocumentation\u002Ffehler\u002Fhyperv",{"rel":199,"titel":200,"zu":201},"fehler\u002Finstall-assist","When Setup fails on the target computer","\u002Fen\u002Fdocumentation\u002Ffehler\u002Finstall-assist",{"rel":203,"titel":204,"zu":205},"fehler\u002Fantwortdatei","The answer file","\u002Fen\u002Fdocumentation\u002Ffehler\u002Fantwortdatei",{"titel":207,"pfad":208,"seiten":209},"Reference","referenz",[210,214,218],{"rel":211,"titel":212,"zu":213},"referenz\u002Fbekannte-probleme","Known issues","\u002Fen\u002Fdocumentation\u002Freferenz\u002Fbekannte-probleme",{"rel":215,"titel":216,"zu":217},"referenz\u002Fdiagnose-und-protokolle","Diagnostics and logs","\u002Fen\u002Fdocumentation\u002Freferenz\u002Fdiagnose-und-protokolle",{"rel":219,"titel":220,"zu":221},"referenz\u002Fglossar","Glossary","\u002Fen\u002Fdocumentation\u002Freferenz\u002Fglossar",{"titel":223,"pfad":224,"seiten":225},"Windows appendix","windows-anhang",[226,230,234],{"rel":227,"titel":228,"zu":229},"windows-anhang\u002Fdienste","Services","\u002Fen\u002Fdocumentation\u002Fwindows-anhang\u002Fdienste",{"rel":231,"titel":232,"zu":233},"windows-anhang\u002Faufgaben","Scheduled tasks","\u002Fen\u002Fdocumentation\u002Fwindows-anhang\u002Faufgaben",{"rel":235,"titel":236,"zu":237},"windows-anhang\u002Fapps","App packages","\u002Fen\u002Fdocumentation\u002Fwindows-anhang\u002Fapps",{"titel":239,"pfad":240,"seiten":241},"Policy appendix","richtlinien-anhang",[242,246,250,254,258,262,266,270,274,278,282,286,290],{"rel":243,"titel":244,"zu":245},"richtlinien-anhang\u002Frichtlinien","Policy reference","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien",{"rel":247,"titel":248,"zu":249},"richtlinien-anhang\u002Frichtlinien-office-haertung","Office hardening","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-office-haertung",{"rel":251,"titel":252,"zu":253},"richtlinien-anhang\u002Frichtlinien-edge-internet-explorer","Edge and Internet Explorer","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-edge-internet-explorer",{"rel":255,"titel":256,"zu":257},"richtlinien-anhang\u002Frichtlinien-virenschutz-angriffsflaechen","Virus protection and attack surface","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-virenschutz-angriffsflaechen",{"rel":259,"titel":260,"zu":261},"richtlinien-anhang\u002Frichtlinien-netzwerk-freigaben","Network and file sharing","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-netzwerk-freigaben",{"rel":263,"titel":264,"zu":265},"richtlinien-anhang\u002Frichtlinien-datenschutz-telemetrie","Privacy and telemetry","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-datenschutz-telemetrie",{"rel":267,"titel":268,"zu":269},"richtlinien-anhang\u002Frichtlinien-protokollierung-ueberwachung","Logging and auditing","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-protokollierung-ueberwachung",{"rel":271,"titel":272,"zu":273},"richtlinien-anhang\u002Frichtlinien-anmeldung-konten","Sign-in and accounts","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-anmeldung-konten",{"rel":275,"titel":276,"zu":277},"richtlinien-anhang\u002Frichtlinien-geraete-wechselmedien","Devices and removable media","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-geraete-wechselmedien",{"rel":279,"titel":280,"zu":281},"richtlinien-anhang\u002Frichtlinien-kernschutz","Kernel protection","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-kernschutz",{"rel":283,"titel":284,"zu":285},"richtlinien-anhang\u002Frichtlinien-laufwerksverschluesselung","Drive encryption","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-laufwerksverschluesselung",{"rel":287,"titel":288,"zu":289},"richtlinien-anhang\u002Frichtlinien-windows-update","Windows Update","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-windows-update",{"rel":291,"titel":292,"zu":293},"richtlinien-anhang\u002Frichtlinien-grundeinstellungen","Defaults and privacy settings","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-grundeinstellungen",null,1793199131002]