The latest error message from Microsoft Defender in Windows 11 has left many users frustrated. The warning message “The protection provided by the local [sic] Security authority is disabled. Your device may be vulnerable” appears in the Windows 11 Security Center and does not go away, even after activation and system reboot.
Microsoft has acknowledged that the error message is unintentional. The Windows 11 Security Center displays the message if it perceives that the LSA protection is not active. The “Protection by local security authority” is a mechanism that is meant to protect user login information.
Microsoft explains that this mechanism prevents the loading of unsigned drivers and plug-ins from the local security authority. When used in combination with SecureBoot and UEFI-Lock, the LSA protection is intended to stop drivers and processes from accessing unauthorized memory areas and reading out login information.
The error message is a false positive, which means that administrators are free to enable the option and restart the system. However, after the restart, the message still appears. Microsoft has confirmed the issue and attributes it to a single update for Windows Defender that takes it to version 1.0.2302.21002.
To fix the issue, users are advised to wait for an update that will fix the issue. This update is currently in development, and Microsoft has stated that it will keep users updated on its progress. In the meantime, users can ignore the false error message and check whether LSA protection is active using the event log. The WinInit event “12: LSASS.exe was started as a protected process with level: 4” will appear in the system log under the Windows logs if LSA protection is active.
Microsoft advises users against other remedies that may be found online, such as modifying the Windows registry. Instead, users should wait for the upcoming update from Microsoft that will put an end to the problem.
