Can't find exact information on the difference in Window 11 between: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] "RunAsPPLBoot"=dword:00000001 and [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] "RunAsPPLBoot"=dword:00000002 Value of 2 is, supposedly, proposed as a fix for when there are related errors, but I am not certain. I think 0 means undefined, 1 means enabled, and 2 means disabled, but again, not certain. I want the value for the strictest protection.
After Windows Security reported LSA to be OFF, I have settled with this "fix" Code: reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v "RunAsPPL" /t REG_DWORD /d "1" /f reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v "RunAsPPLBoot" /t REG_DWORD /d "2" /f