How do I enable LSA Protection through Group Policy and fix UEFI issues

Siti Lestari 0 Reputation points
2026-09-08T02:04:56.52+00:00

I’m currently facing a problem where enabling LSA Protection (RunAsPPL) through the Registry doesn’t stay active after reboot. It seems the host’s UEFI firmware rejects the security variable update, causing the protection setting to revert. I need guidance on how to properly deploy LSA Protection via Group Policy and also clear stale UEFI variables that prevent persistence.

NOTE: I’ve already tried manual registry edits and firmware resets, but the setting still fails to apply after restart. I’d appreciate help in finding a reliable way to enforce LSA Protection across devices and ensure UEFI variables don’t block the update.

Windows for business | Windows 365 Enterprise
0 comments

1 answer

Sort by: Newest
Most helpful Newest Oldest
  1. Jason Nguyen Tran 25,120 Reputation points Independent Advisor
    2026-09-08T02:48:02.9066667+00:00

    Hello Siti Lestari,

    You’re correct that enabling LSA Protection (RunAsPPL) via registry edits alone can fail to persist when UEFI variables block the update. The supported way to enforce LSA Protection across devices is through Group Policy. You can configure this under Computer Configuration > Administrative Templates > System > Local Security Authority > “Configure LSASS to run as a protected process.” This ensures the setting is applied consistently at boot, without relying on manual registry changes.

    If UEFI variables are stale or corrupted, the recommended approach is to clear them using the firmware setup utility or vendor-specific tools. In some cases, updating the UEFI firmware itself resolves the rejection of security variable updates. After clearing or updating, reapply the Group Policy setting and confirm persistence across reboots.

    It’s also important to verify Secure Boot is enabled and the system firmware is fully up to date, as these are prerequisites for LSA Protection to remain active. Testing on a subset of devices before broad rollout is a good way to validate that the UEFI variables no longer interfere.

    I hope the response provided some helpful insight. If you find this answer useful, please hit “accept answer” so I know it addressed your concern.

    Jason

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.