3.8 KiB
title, description, ms.author, ms.topic, ms.prod, ms.technology, author, ms.localizationpriority, ms.date, ms.reviewer, manager
| title | description | ms.author | ms.topic | ms.prod | ms.technology | author | ms.localizationpriority | ms.date | ms.reviewer | manager |
|---|---|---|---|---|---|---|---|---|---|---|
| Policy CSP - LocalSecurityAuthority | Define the list of trusting forests that the Kerberos client searches when attempting to resolve two-part service principal names (SPNs). | dansimp | article | w10 | windows | dansimp | medium | 08/26/2022 | dansimp |
Policy CSP - LocalSecurity Authority
LocalSecurityAuthority policies
Tip
These are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see Understanding ADMX-backed policies.
You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to Enabling a policy.
The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see CDATA Sections.
LocalSecurityAuthority/AllowCustomSSPsAPs
| Edition | Windows 10 | Windows 11 |
|---|---|---|
| Home | No | No |
| Pro | Yes | Yes |
| Business | Yes | Yes |
| Enterprise | Yes | Yes |
| Education | Yes | Yes |
[!div class = "checklist"]
- Device
This policy setting defines whether the Local Security Authority Subsystem Service (LSASS) will allow loading of custom security support providers (SSPs) and authentication providers (APs).
If you enable this policy setting or do not configure it, LSASS will allow loading of custom SSPs and APs.
If you disable this policy setting, LSASS will block custom SSPs and APs from loading.
ADMX Info:
- GP Friendly name: Allow Custom SSPs and APs to be loaded into LSASS
- GP name: AllowCustomSSPsAPs
- GP path: System/Local Security Authority
- GP ADMX file name: LocalSecurityAuthority.admx
Kerberos/ConfigureLsaProtectedProcess
| Edition | Windows 10 | Windows 11 |
|---|---|---|
| Home | No | No |
| Pro | Yes | Yes |
| Business | Yes | Yes |
| Enterprise | Yes | Yes |
| Education | Yes | Yes |
[!div class = "checklist"]
- Device
This policy setting configures the Local Security Authority Subsystem Service (LSASS) to run as a protected process.
If you disable (0) or do not configure this policy setting, LSASS will not run as a protected process.
If you enable this policy with UEFI lock (1), LSASS will run as a protected process and this setting will be stored in a UEFI variable.
If you enable this policy without UEFI lock (2), LSASS will run as a protected process and this setting will not be stored in a UEFI variable.
ADMX Info:
- GP Friendly name: Configure LSASS to run as a protected process
- GP name: ConfigureLsaProtectedProcess
- GP path: System/Local Security Authority
- GP ADMX file name: LocalSecurityAuthority.admx