Managing Multiple LSA Security Settings with PowerShell Script

In modern IT environments, hardening security on Windows systems involves configuring critical registry settings related to authentication and access control. This PowerShell script automates the configuration of several important Local Security Authority (LSA) settings by ensuring specific values are applied to key security-related registry entries.

This article explains how the script works, what each setting controls, and why enforcing these values enhances security.

Understanding the LSA Security Settings

The script targets four critical LSA settings in the Windows Registry:

Setting	Description	Security Impact
RestrictAnonymous	Controls anonymous access to resources	Prevents information gathering by attackers
RunAsPPL	Protected Process Light for LSA	Protects against malware manipulation
DisableDomainCreds	Controls local credential storage	Reduces credential theft risk
RestrictAnonymousSAM	SAM database access control	Prevents unauthorized password hash access

Detailed LSA Settings Configuration

1. RestrictAnonymous

Registry Value: 1 = Restrict anonymous access

Business Value: Controls the level of anonymous access to resources. Setting this value to 1 restricts anonymous users from obtaining a list of account names and shares, improving security by preventing certain types of information gathering by attackers.

2. RunAsPPL (Protected Process Light)

Registry Value: 1 = Enable Protected Process Light

Business Value: Ensures that LSA runs as a Protected Process Light (PPL), providing stronger protection against malware that might try to interact with or manipulate authentication services.

3. DisableDomainCreds

Registry Value: 1 = Disable storing domain credentials

Business Value: Controls whether Windows stores credentials locally. Setting this to 1 disables storing credentials on local machines, forcing users to authenticate directly against the domain for each session, which reduces the risk of credential theft.

4. RestrictAnonymousSAM

Registry Value: 1 = Restrict anonymous SAM access

Business Value: Prevents anonymous users from accessing the Security Accounts Manager (SAM) database, which stores password hashes. Restricting access to SAM improves security by preventing unauthorized access to sensitive authentication data.

Security Impact Analysis

These LSA settings are critical for hardening authentication mechanisms and access control in Windows environments. By enabling these features, you reduce the risk of attacks such as credential harvesting, privilege escalation, and unauthorized access.

Security Benefits by Setting:

Setting	Attack Prevention	Risk Reduction
RestrictAnonymous	Network enumeration attacks	Prevents reconnaissance phase
RunAsPPL	LSA process tampering	Reduces malware interaction
DisableDomainCreds	Cached credential abuse	Lowers credential theft risk
RestrictAnonymousSAM	SAM database exploitation	Blocks password cracking attempts

PowerShell Implementation

$keyPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"
$keyNames = @("RestrictAnonymous", "RunAsPPL", "DisableDomainCreds", "RestrictAnonymousSAM")
$keyValue = 1

foreach ($keyName in $keyNames) {
    if ((Get-ItemProperty -Path $keyPath -Name $keyName -ErrorAction SilentlyContinue).$keyName -ne $keyValue) {
        New-ItemProperty -Path $keyPath -Name $keyName -Value $keyValue -PropertyType DWORD -Force | Out-Null
    }
    else {
        Set-ItemProperty -Path $keyPath -Name $keyName -Type DWORD -Value $null -Force | Out-Null
    }
}

Conclusion

Key Takeaway: Implementing these LSA security settings provides a foundational layer of protection for Windows authentication systems. The automated PowerShell script ensures consistent application across your environment, reducing manual configuration errors and strengthening your security posture.

By systematically applying these registry settings, organizations can significantly enhance their Windows security posture and protect against common attack vectors targeting authentication mechanisms.