LSA Hardening: RunAsPPL, WDigest, and Stopping Credential Theft at LSASS

Almost every serious Windows compromise runs through one process: lsass.exe. The Local Security Authority Subsystem Service is where Windows keeps the secrets it needs to prove who you are — NTLM hashes, Kerberos tickets, DPAPI master keys, and, on badly configured machines, plaintext passwords. If an attacker who already has local admin can read LSASS memory, they don't need to crack anything. They just harvest the credentials that are sitting there and pivot to the next machine.

The good news is that Windows ships several controls that make LSASS a much harder target — and every one of them is a registry value you can check and set in seconds. This post walks through the four that matter most, why each one matters to an attacker, and the exact keys WinSentinel's LSA hardening module audits and can fix for you.

Why LSASS is the crown jewel

When you log in, LSASS validates your credentials and then caches material so you aren't prompted again every time you touch a network share. That cache is the whole point of single sign-on — and the whole problem. Tools like Mimikatz became infamous precisely because they read this cached material straight out of LSASS memory. Two attack primitives dominate:

• Pass-the-Hash — steal an NTLM hash and authenticate as that user without ever knowing the password.
• Pass-the-Ticket — steal a Kerberos TGT and impersonate the user across the domain.

Both need one thing: read access to LSASS. Hardening LSA is about taking that access away, and about making sure there are no plaintext passwords sitting in memory to grab in the first place.

1. RunAsPPL — turn LSASS into a Protected Process

LSA Protection (RunAsPPL) tells Windows to run LSASS as a Protected Process Light. A PPL can only be opened by other protected processes of equal or higher signing level, so a normal admin-level tool — even running as SYSTEM — can no longer call OpenProcess against LSASS to read its memory. This single control blocks the most common credential-dumping path.

Key:   HKLM\SYSTEM\CurrentControlSet\Control\Lsa
Value: RunAsPPL         (DWORD) = 1   ; enable LSA Protection
Value: RunAsPPLBoot     (DWORD) = 1   ; enforce at boot (Win11 22H2+)

The catch: PPL is enforced at boot, so it takes effect after a restart. Third-party security drivers that legitimately inspect LSASS must be properly signed, or they'll be denied — test on a pilot ring first. On modern Windows 11, LSA protection is increasingly on by default, but on servers and upgraded machines it frequently is not.

2. WDigest — the plaintext caching you must turn off

WDigest is a legacy authentication protocol from the Windows XP / Server 2003 era. Its defining, dangerous behavior: it caches the user's password in plaintext in LSASS memory so it can answer digest challenges. If WDigest caching is enabled, an attacker who dumps LSASS doesn't get a hash they have to crack — they get the password itself.

Microsoft disabled this by default starting with Windows 8.1 / Server 2012 R2 and shipped a patch (KB2871997) to disable it on older systems. But the setting can be — and on legacy or misconfigured machines still is — turned back on. WinSentinel flags an enabled WDigest cache as Critical, because it converts a difficult offline-cracking problem into a trivial copy-paste.

Key:   HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest
Value: UseLogonCredential  (DWORD) = 0   ; 0 = do NOT cache plaintext

If UseLogonCredential is 1 — or, on some builds, simply missing where an old policy expects it — plaintext caching is active. Set it to 0.

3. NoLMHash — stop storing the ancient LM hash

The LAN Manager (LM) hash is a pre-Windows-2000 password representation so weak it can be brute-forced in minutes on commodity hardware. Windows should never store it anymore, but the setting exists and can be disabled. Ensure the OS is forbidden from computing and storing LM hashes:

Key:   HKLM\SYSTEM\CurrentControlSet\Control\Lsa
Value: NoLMHash  (DWORD) = 1   ; 1 = do not store LM hashes

4. Cached logons and AutoAdminLogon

Two more LSA-adjacent settings round out the picture:

• Cached interactive logons (CachedLogonsCount) let a domain user sign in when a domain controller is unreachable — useful for laptops, risky on always-connected servers, because those cached verifiers can be extracted and cracked offline. A count of 10 is the default; hardened servers often drop it to 0–4.
• AutoAdminLogon stores a password in plaintext in the registry so a machine can auto-login. WinSentinel treats a configured DefaultPassword under Winlogon as Critical — it's a cleartext credential readable by anyone who can read the registry.

Key:   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Value: CachedLogonsCount   (REG_SZ) = "4"   ; lower = safer
Value: AutoAdminLogon      (REG_SZ) = "0"   ; and remove DefaultPassword

How WinSentinel audits this

WinSentinel's LSA hardening analyzer reads each of these values directly from the registry — no scripts to paste, no guesswork about which key applies to your build — and reports them in the Credentials category with a severity that reflects real-world impact: WDigest plaintext caching and a stored AutoAdminLogon password are Critical; missing RunAsPPL and a high cached-logon count are graded down from there. Every finding ships with the exact remediation and a fix command, so you go from "am I exposed?" to "fixed" in one pass:

winsentinel audit --category credentials

Because this is a single-machine control, it's part of the free, open-source WinSentinel core — no license required. Run it on every workstation and server you own; the whole point of LSA hardening is that it's cheap to check and expensive to skip.

Credential theft is the hinge of nearly every lateral-movement story. You don't stop it by buying more tooling — you stop it by making LSASS unreadable and making sure there are no plaintext passwords in it to steal. Four registry values do most of that work.

The one-minute checklist

• RunAsPPL = 1 (and reboot) — LSASS runs as a Protected Process.
• WDigest\UseLogonCredential = 0 — no plaintext password caching.
• NoLMHash = 1 — no weak LM hashes stored.
• CachedLogonsCount low on servers; AutoAdminLogon = 0 with no DefaultPassword.

Set those four and you've closed the door on the credential-dumping techniques behind most Windows breaches. WinSentinel checks them — and everything else on the machine — in a single audit.