LSA Protection is a Windows hardening feature that helps safeguard the Local Security Authority Subsystem Service, or LSASS. It runs LSASS as a protected process so ordinary, untrusted processes cannot easily open it for reading, memory access, or code injection. This matters because LSASS often holds authentication material and is a common target for credential-dumping attacks.
In real environments, enabling LSA Protection raises the cost of techniques such as process memory scraping and remote thread injection against lsass.exe. Defenders use it alongside Credential Guard, attack surface reduction rules, and least privilege to reduce credential theft risk. Attackers may try to work around it by abusing trusted or signed components, exploiting kernel-level access, or targeting systems where the feature is disabled or misconfigured. Even when it is not a complete defense, it is an important barrier that can stop many common post-exploitation tools from touching LSASS.