LSA protection - Running LSASS as protected process in Windows 10 22H2

[Windows 10]

We are running Windows 10 22H2 (will soon upgrade to Windows 11 23H2).We would like to enable added LSA protection preferably without UEFI lock on our machines as outlined in Configure added LSA protection | Microsoft Learn. However, the methods to implement it this way only refer to Windows 11 22H2 and later.I ran a test on a Win 10 machine by editing the registry as below. Then rebooted.HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa"RunAsPPL"=dword:00000002And surprisingly, after reboot, the System log shows the following WinInit event:12: LSASS.exe was started as a protec

Continue reading...