LSA Protection (RunAsPPL)

Whether LSASS runs as a protected process so its memory cannot be read easily.

Use it to tell whether LSASS was protected against memory reads, and spot that protection removed.

SYSTEM
Defence Evasion

What It Is

The Local Security Authority (LSA), which runs in the lsass.exe process, checks users at local and remote sign-ins and enforces the machine's security policy. Its settings live in the Lsa key of the SYSTEM hive, where RunAsPPL, short for run as protected process light (PPL), makes lsass.exe a protected process. Ordinary processes cannot read a protected process's memory or load code into it, which guards the credentials the LSA stores. The setting applies after a restart, and qualifying new installs of Windows 11 22H2 and later have it on by default.

What It Proves

RunAsPPL set to 1 or 2 makes LSASS a protected process, so ordinary admin tools cannot read its memory. A missing or 0 value means that barrier is down.

What It Does Not Prove

It shows the configured state, not that memory was read. It takes effect only after a reboot, and on Windows 11 22H2 and later it may be held by a UEFI variable.

Where It Lives

LSA Protection (RunAsPPL) lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

SYSTEM\ControlSet001\Control\Lsa

C:\Windows\System32\config\SYSTEM

What It Looks Like

These are two values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in LSA Protection (RunAsPPL), each with what it tells you
Registry Value	What It Tells You
`RunAsPPL` `REG_DWORD0x00000001 (1)`	LSASS is set to run protected, with a UEFI lock on Secure Boot devices that a registry edit cannot undo. WinInit event 12 in the System log confirms it.
`RunAsPPL` `REG_DWORD0x00000000 (0)`	LSA protection is configured off, so admin tools can read LSASS memory. If WinInit event 12 is missing from the System log after boot, treat the host credentials as exposed.

How to Read It

Read RunAsPPL under Control\Lsa in each ControlSet. 1 means enabled with a UEFI lock, 2 enabled without a lock, 0 or missing means off. To put it right, set it to 1, reboot, and review why it was removed.

When Windows Writes It: It is written when an administrator or an attacker with admin rights sets the value. It takes effect at the next boot.
Which Windows Versions: Windows 8.1 and Server 2012 R2 to 11 (UEFI-enforced on 11 22H2 and later)
Tools That Parse It: Registry Explorer, RECmd, RegRipper (lsa)

Hunt It

Sees It DirectlyDeviceRegistryEvents

Defender records other values in the Lsa key, but confirm RunAsPPL writes appear before relying on it. A delete carries the name in the Previous columns. A hit shows the setting, which takes effect only after a reboot.

KQLDefender XDR, Advanced hunting

// LSA protection (RunAsPPL) changed or removedDeviceRegistryEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where RegistryKey endswith @"\Control\Lsa" or PreviousRegistryKey endswith @"\Control\Lsa"| where RegistryValueName =~ "RunAsPPL" or PreviousRegistryValueName =~ "RunAsPPL"| project Timestamp, ActionType, RegistryKey, RegistryValueName, RegistryValueData, PreviousRegistryValueData, InitiatingProcessAccountName, InitiatingProcessCommandLine| order by Timestamp desc

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what LSA Protection (RunAsPPL) shows.

Process Access to lsass.exe, Sysmon Event 10Not in the RegistryShows which processes opened lsass.exe while the barrier was down.

Sources

The facts on this page come from these public pages, which say more on each point.