
close
close
Chance to win $250 in Petri 2023 Audience Survey
In my previous Ask an Admin post, I described the new LSA protected mode in Windows Server 2012 R2 and Windows 8.1, how it works, and how to enable the setting. LSA protected mode is not turned on out-of-the-box, except in Windows 8.1 RT where it cannot be disabled because it may cause compatibility issues with some third-party applications, such as smart card drivers or self-service password reset applications.
In this article, I’ll describe how to enable auditing so you can identify drivers or plug-ins that fail to load in LSA protected mode.
There are a couple of requirements that LSA drivers and plug-ins must comply with to work with protected mode:
In the example, we’ll configure LSA auditing on computers in your domain. You don’t need to enable LSA protected mode itself; if an LSA driver or plug-in doesn’t meet the necessary requirements for protected mode, an event will be logged but the driver or plug-in will not be blocked from loading.
Log on to a Windows Server 2012 R2 domain controller with an account that has permission to create and link Group Policy Objects (GPOs):
Once the Group Policy has applied to a machine in scope, you can check in the machine’s Event Viewer for any potential problems loading LSA drivers or plug-ins in protected mode.
Event ID 3065 shows that the driver or plug-in didn’t comply with SDL best practices for Shared Sections. Event ID 3066 indicates that a plug-in or driver didn’t pass a code integrity check because it wasn’t signed by Microsoft.
In a large environment, you might want to set up Event Forwarding to collect the logs from multiple computers in a central location for convenience.
More in Security
Git Releases New Security Updates to Block Remote Code Execution Attacks
Jan 18, 2023 | Rabia Noureen
Bitwarden – An Open-Source Alternative to LastPass for Business and Personal Use
Jan 3, 2023 | Russell Smith
LastPass Confirms Hackers Stole Personal Data and Encrypted Password Vaults
Dec 23, 2022 | Rabia Noureen
Most popular on petri