Fix This change requires you to restart your device LSA Protection Error in Windows

Are you unable to turn on Local Security Authority Protection in spite of restarting your device? Several users report that they cannot enable LSASS and come across a red warning text “This change requires you to restart your device” in Windows 11 or 10.  They try to reboot the computer hoping that the Local Security Authority Protection will be turned on but it fails. The warning remains unchanged and LSASS is still in the disabled state.

Let’s see What it’s LSA aka Local Security Authority Protection first. The logon process is initiated when a user attempts to locally log onto the system by entering their username and password in the logon dialog box. The LSA is then invoked, which forwards the user’s credentials to the Security Accounts Manager (SAM). The SAM is responsible for managing the account information stored in the local SAM database. It compares the user’s credentials with the account information in the SAM database to ascertain whether the user is authorized to access the system. Upon locating the user account information in the SAM database, the SAM proceeds to authenticate the user. It accomplishes this by creating a logon session and returning the user’s security identifier (SID) and the SIDs of any global groups to which the user belongs to the LSA. When the issue Change requires you to restart your device appears in Windows Defender Core isolation Local Security Authority Protection or LSAP there may need to change Policy settings or registry, and more. See – How to Fix Windows Defender Not Working in Windows 10. Now, let’s follow the solutions –

This change requires you to Restart your device Local Security Authority Protection Windows Defender Core Isolation

Here is how to Fix This change requires you to restart your device LSA Protection Error in Windows –

Way-1: Change Group Policy Settings

If the LSAAS is not turned on in spite of enabling the setting and restarting the computer Settings in Group Policy allows you to enable, disable and configure Local Security Authority in Windows 11 or 10. The policy states:

“1] If you do not configure this policy and there is no current setting in the registry, LSA will run as protected process for clean installed, HVCI capable, client SKUs that are domain or cloud domain joined devices. This configuration is not UEFI locked. This can be overridden if the policy is configured.

2] If you configure and set this policy setting to “Disabled”, LSA will not run as a protected process.

3] If you configure and set this policy setting to “EnabledWithUEFILock,” LSA will run as a protected process and this configuration is UEFI locked.

4] If you configure and set this policy setting to “EnabledWithoutUEFILock”, LSA will run as a protected process and this configuration is not UEFI locked.”

Correct configuration of this Policy will remove “This change requires you to restart your device” message and turn on Local Security Authority Protection as well. Therefore, follow the steps –

1. Hold down Windows key and press R.
2. Type gpedit.msc.
3. Click on OK to launch Group Policy Editor.
4. Reach the location – “Computer Configuration > Administrative Templates > System > Local Security Authority”.
5. Double-click on the setting – Configure LSASS to run as a protected process.

6. Check the option Enabled on the Policy Settings window.
7. From the Options section, click on the drop-down and choose – Enabled with UEFI Lock.
8. Click on Apply and OK then close the Group Policy Editor.

See to know – lsass.exe in Windows 10 – What is it and How works.

Way-2: Modify Registry Entries to Fix This change requires you to restart your device LSA Protection Error

Furthermore, modifying the related registry entries may also fix This change requires you to Restart your device for Local Security Authority Protection and turn on the settings. Move forward with the instructions –

1. Click on Start.
2. Type regedit.exe.
3. Hit Enter.
4. When a User account control appears, click on Yes.
5. On the Registry Editor, navigate to the following key –

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

6. Go to the right side of the window, right-click on an empty space, and select New > Edit DWORD (32-bit) Value.
7. Rename the New Value #1 to RunAsPPLBoot.
8. Double-click on this Value and set the Value data to 2.
9. In the same way, create one more Value RunAsPPL and also set its value data 2.

10. Restart the computer and try to turn on Local Security Authority Protection in the Windows Security app.

Way-3: Run System File Checker and DISM

SFC can be handy when LSASS is turned off or disabled because of corrupted system files or conflicts between different elements. Furthermore,  if glitches in installation files cause the Local Security Authority disabled problem, DISM will help rescue it. So, use them follow the below guide –

1. Press Winkey+R.
2. Type cmd.exe.
3. Then press Ctrl + Shift + Enter.
4. On the UAC popup, click on Yes.
5. Type the cmd command SFC /Scannow.
6. Hit the “Enter” key.
7. Once Scanning verification, and repairing phases are 100 percent completed and the tool shows Windows Resource Protection did not find any integrity violations, restart the PC and check if LSASS issue is fixed.
8. Otherwise, again launch the Command Prompt and run the following commands successively –

DISM /Online /cleanup-Image /checkhealth 
DISM /Online /cleanup-Image /scanhealth 
DISM /Online /cleanup-Image /restorehealth

9. After finishing the process, reboot the device and see if the error is fixed.

Way-4: Reset the Windows Security app

LSA bug can also be triggered due to faulty Windows security app itself and resetting this can solve the issue. Apps Settings include tools to reset, repair, and terminate every built-in application, hence go with the steps –

1. Right click on “Start” button and choose Settings.
2. Select Apps from the left panel.
3. Go to the right side and click on Installed apps.
4. Locate Windows security in the list.
5. Click on the 3 dots icon (ellipsis).
6. Click on – Advanced options.
7. On the next page, select Reset.
8. Confirm the process by again clicking on “Reset”.

9. Now go to Settings > Privacy & security > Windows Security > Device Security >  Core isolation details > Local  Security Authority Protection and turn it on.

Read – How to Reset Windows Security App in Windows 11 or 10.

Way-5: Install Pending updates

This change requires you to restart your device LSASS in Windows 11 or 10 occurs because of bugs in Security app so there is possibility of patches that can fix the issue. So check for pending updates and install if any are available –

1. Press – Win+S.
2. Type – updates.
3. Click on – “Windows Update”.
4. Select – ‘Check for updates’.

5. Give a little time to complete scanning and downloading the pending update.
6. Click on Restart now when you are asked.

Methods:
Way-1: Change Group Policy Settings
Way-2: Modify Registry Entries
Way-3: Run System File Checker and DISM
Way-4: Reset the Windows Security app
Way-5: Install Pending updates

That’s all!!