Giveaway of the Day Forums

1. 

   mikiem2
   Moderator

   bleepingcomputer[.]com/news/microsoft/microsoft-enables-lsa-protection-by-default-in-windows-canary-build/

   Starting this week [AFAIK] the security icon or shield in the Taskbar notification area may show a warning indicating that something's wrong. Clicking that icon should bring up the Settings security window, in this case showing a problem with the device security. Under Settings -> Device Security -> Core Isolation, you'll see the switch for Local Security Authority protection is off & a warning is shown. Alternatively, if Windows decides / detects that the hardware is incompatible, you'll only see a notice that it's off. In either case you can click Dismiss to get rid of the warning on the Taskbar icon.

   If you decide to flip the switch, turning Local Security Authority protection on, you'll see a notice that you have to restart Windows for it to take effect. After a restart it may, or may not be turned on -- in the latter case the switch will be turned on, but it'll tell you it's off. There are two registry entries that have to be added or edited for it to work, and simply turning LSA protection on may not make those registry changes. To make those changes yourself, either add or edit the entries using Regedit, or copy the following to a text file in Notepad, saving it with a filename [SomeName].reg, then double clicking the file to merge it with the registry.

   ----------------

   Windows Registry Editor Version 5.00

   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
   "RunAsPPL"=dword:00000002
   "RunAsPPLBoot"=dword:00000002

   -------------------

   Posted 1 year ago #
2. 

   mikiem2
   Moderator

   bleepingcomputer[.]com/news/microsoft/microsoft-defender-update-behind-windows-lsa-protection-warnings/

   learn.microsoft[.]com/en-us/windows/release-health/status-windows-11-22H2#-local-security-authority-protection-is-off---with-persistent-restart

   I had never heard of LSA Protection, & did not have it enabled on any of our devices running Win11, so the warnings I saw were something new that Microsoft added or started. Showing the warning *when it's turned on* is a bug that Microsoft's acknowledged. Microsoft however doesn't want folks playing with Windows registry, and suggests that you just click "dismiss" to get rid of the warning instead. They recommend using Event Viewer if you want to verify if it's on or off.

   Posted 1 year ago #
3. 

   mikiem2
   Moderator

   neowin[.]net/news/microsoft-may-have-fixed-lsa-bug-with-kernel-mode-hardware-stack-protection-in-windows-11/

   There's not a lot of certainty on what's going on, including in the linked Neowin article, but there's a Defender update being pushed out that, at least in my case with multiple copies of Win11, eliminates the LSA Protection setting entirely. There is however a new setting on the security page below Memory integrity: Kernel-mode Hardware-enforced Stack Protection, with a note that it requires Memory integrity enabled to work [I have that off so just clicked the dismiss button or link]. Doing a quick Google found a Microsoft article explaining Kernel-mode Hardware-enforced Stack Protection, for Win10. ¯\_(ツ)_/¯

   techcommunity.microsoft[.]com/t5/windows-os-platform-blog/understanding-hardware-enforced-stack-protection/ba-p/1247815

   Hardware-enforced Stack Protection offers robust protection against ROP exploits since it maintains a record of the intended execution flow of a program. To ensure smooth ecosystem adoption and application compatibility, Windows will offer this protection as an opt-in model, so developers can receive this protection, at your own pace.

   Posted 1 year ago #
4. 

   mikiem2
   Moderator

   bleepingcomputer[.]com/news/microsoft/microsoft-defender-update-causes-windows-hardware-stack-protection-mess/

   Apparently things get worse if you have Kernel-mode Hardware-enforced Stack Protection enabled...

   Windows 11 users now report seeing Windows security notifications that the new feature is disabled due to conflicting drivers.

   "Kernel-mode Hardware-enforced Stack Protection is off. Your device may be vulnerable," reads a warning in the Windows Security Center.

   However, when they examine the list, it is empty, making it confusing how to enable the feature.

   Even worse, some conflicting game anti-cheat drivers are not detected as incompatible, and Kernel-mode Hardware-enforced Stack Protection is still enabled. These conflicting drivers are causing Windows to crash or for games not to run when the security feature is enabled and a game is launched.

   Windows 11 users have reported these problems for PUBG, Valorant (Riot Vanguard), Bloodhunt, Destiny 2, Genshin Impact, Phantasy Star Online 2 (Game Guard) and Dayz.

   Posted 1 year ago #
5. 

   mikiem2
   Moderator

   bleepingcomputer[.]com/news/microsoft/microsoft-removes-lsa-protection-from-windows-settings-to-fix-bug/

   Removing the toggle for Local Security Authority protection in settings was apparently the fix, or part of it anyway. Bleeping Computer's article includes the link to Microsoft's instructions on how to turn LSA protection on/off -- the registry entry to turn it on is the same one published by 3rd parties originally to get the warning to go away, and then Microsoft said don't do that (?).

   learn.microsoft[.]com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection#how-to-enable-lsa-protection-on-a-single-computer

   Bleeping Computer also repeats [again] Microsoft's instructions on how to tell if LSA protection is on or off by checking in Event Viewer -- it's not really helpful since neither tells you HOW or WHERE to look... Event Viewer is in Control Panel -> Windows Tools, or just use search. Once you have it open, on the left side go to Windows Logs -> System. Then right click System, & click on "Filter Current Log...". In the window that opens go to "Event sources:" [it's at the bottom of the top 1/2], & scroll down in the dropdown, selecting Wininit, then clicking elsewhere in the window to close the dropdown. Click OK & look at the entries in the top center pane of Event Viewer -- the 4th column is Event ID, & you're looking for 12. Select that entry, and in the lower pane you'll see the details -- if it says: "LSASS.exe was started as a protected process with level: 4." LSA protection is turned on.

   Posted 1 year ago #
6. 

   mikiem2
   Moderator

   bleepingcomputer[.]com/news/microsoft/microsoft-pulls-defender-update-fixing-windows-lsa-protection-bug/

   neowin[.]net/news/microsoft-admits-it-couldnt-really-fix-windows-11-security-and-defender-lsa-issues/

   windowscentral[.]com/software-apps/windows-11/microsofts-patch-didnt-actually-fix-windows-defender-but-theres-a-workaround

   Well, it's an even bigger mess now... enabling Kernel-mode Hardware-enforced Stack Protection is causing some people to experience BSODs & restarts, so Microsoft pulled the Defender update that was supposed to fix everything, but didn't.

   Posted 1 year ago #
7. 

   mikiem2
   Moderator

   bleepingcomputer[.]com/news/microsoft/microsoft-fixes-bug-behind-windows-lsa-protection-warnings-again/

   Microsoft is again pushing a Defender Antivirus update (first issued in April and pulled in May) that fixes a known issue triggering Windows Security warnings that Local Security Authority (LSA) Protection is off.

   Microsoft acknowledged this issue impacts Windows 11 21H2 and 22H2 systems after numerous user reports about "Local Security Authority protection is off. Your device may be vulnerable." warnings, although LSA Protection was already enabled.

   LSA Protection safeguards Windows users from credential theft by blocking the injection of untrusted code into the LSASS.exe process, which could help attackers extract sensitive information.

   While Redmond says the issue stems from a faulty update for the Microsoft Defender Antivirus antimalware platform issued in May, affected customers have been reporting seeing these LSA Protection alerts since at least January 15.

   "This issue was resolved in an update for Windows Security platform antimalware platform KB5007651 (Version 1.0.2306.10002)," Microsoft said on Wednesday.

   "If you would like to install the update before it is installed automatically, you will need to check for updates."

   Posted 1 year ago #

RSS feed for this topic

Reply

You must log in to post.