Glossary
LSA protection (RunAsPPL)
Runs LSASS as a protected process light so that even administrators cannot read its memory or inject unsigned code into it.
LSA protection configures the Local Security Authority process, lsass.exe, to run as a protected process light (PPL). Windows then only allows code signed at a sufficient protection level to open LSASS for memory reads or to load modules into it. Common credential dumping tools, which open LSASS from an ordinary administrator process, are refused.
It is enabled with the RunAsPPL value under HKLM\SYSTEM\CurrentControlSet\Control\Lsa (1 with a UEFI variable lock, 2 without) or the Configures LSASS to run as a protected process policy. An audit mode reports incompatible plug-ins first (CodeIntegrity events 3065 and 3066). System event 12 from Wininit confirms that LSASS started as a protected process.