bleepingcomputer[.]com/news/microsoft/microsoft-enables-lsa-protection-by-default-in-windows-canary-build/
Starting this week [AFAIK] the security icon or shield in the Taskbar notification area may show a warning indicating that something's wrong. Clicking that icon should bring up the Settings security window, in this case showing a problem with the device security. Under Settings -> Device Security -> Core Isolation, you'll see the switch for Local Security Authority protection is off & a warning is shown. Alternatively, if Windows decides / detects that the hardware is incompatible, you'll only see a notice that it's off. In either case you can click Dismiss to get rid of the warning on the Taskbar icon.
If you decide to flip the switch, turning Local Security Authority protection on, you'll see a notice that you have to restart Windows for it to take effect. After a restart it may, or may not be turned on -- in the latter case the switch will be turned on, but it'll tell you it's off. There are two registry entries that have to be added or edited for it to work, and simply turning LSA protection on may not make those registry changes. To make those changes yourself, either add or edit the entries using Regedit, or copy the following to a text file in Notepad, saving it with a filename [SomeName].reg, then double clicking the file to merge it with the registry.
----------------
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"RunAsPPL"=dword:00000002
"RunAsPPLBoot"=dword:00000002
-------------------