protect lsa

How to check if LSA Protection was successfully enabled

Posted on by Imran Rashid
Reading Time: < 1 minute
  1. Access Event logs
  2. Access System Logs under Windows
  3. Locate event ID 12, should be labelled as Wininit and display the below message

    LSASS.exe was started as a protected process with Level 4

    A reboot is required after you have enabled LSA Protection

    Please read the below link before applying LSA Protection:

    https://docs.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection