Should I Turn On Local Security Authority Protection?

When It Makes Sense

• Good fit: You manage high‑value workstations or servers in an environment where credential‑dumping malware is a known threat, and you can test software compatibility before rollout.
• Good fit: Your organization enforces strict baseline hardening standards (e.g., CIS Benchmarks) and has a change‑control process that can accommodate any required adjustments.

When You Should Avoid It

• Warning sign: You rely on legacy applications or third‑party security tools that hook into LSASS and are known to break when LSA Protection is enabled.
• Warning sign: Your environment lacks a robust testing sandbox, making it difficult to verify that enabling the feature will not cause system instability.

Pros and Cons

Pros

• Reduces the attack surface by preventing non‑system processes from accessing the LSASS memory, thereby mitigating credential‑theft techniques such as Mimikatz.
• Often satisfies compliance frameworks that require additional Windows hardening measures, providing a documented security control.

Cons

• Can cause compatibility issues with legitimate software that needs to read LSASS data, leading to authentication failures or reduced functionality.
• Enabling the setting may generate additional alerts or false positives in security monitoring tools, increasing operational overhead.

Decision Checklist

• Do you have a reliable method to test the impact of LSA Protection on all critical applications before deployment?
• Is credential dumping a realistic threat in your threat model, and do other controls already address it?
• Can you roll back the change quickly if unforeseen problems arise?

Alternatives to Consider

Instead of enabling LSA Protection outright, you might apply targeted mitigation: use Credential Guard on supported hardware, restrict admin rights, keep systems fully patched, and employ application whitelisting. For environments where compatibility is a concern, consider enabling the setting only on the most sensitive machines.

Final Recommendation

If you manage systems that hold sensitive credentials, have a structured testing process, and can tolerate minor compatibility adjustments, turning on Local Security Authority Protection is a worthwhile hardening step. However, if you depend on legacy software or lack testing resources, defer enabling it until you can mitigate potential disruptions, and consult your security or IT operations team for guidance.