Windows 10: securityhealthservice.exe disabling LSA protection

Greetings,I am experiencing an issue where securityhealthservice.exe process is trying to disable LSA protection. This action is blocked by an antivirus tool on my PC.I am not sure why this is happening. I have searched online if anyone else was experiencing this issue and I have found one thread here on Microsoft community, but the answer was not very clear:https://answers.microsoft.com/en-us/windows/forum/all/securityhealthserviceexe-close-processes/6a3ce163-0cc7-49b7-af83-de8bcd298d0aI have looked into the workings of securityhealthservice.exe and it should not be attempting to disable LSA

:)

 

Disabling LSA protection

We have an internal issue causing something not to work when the LSA protection is enabled.

As we also have "Block credential stealing from the Windows local security authority subsystem (lsass.exe)" ASR rule, and following this recommendation that "having both running at the same time would be redundant" we want to turn off the LSA protection.

The problem starts with the fact that all our devices support Secure Boot and since years we use UEFI based devices.

On those machines the task of disabling LSA protection seems like very cumbersome and not straight forward.

Is there more easy and centralized way to disable LSA protection on a few thousands windows machines?

Thanks in advance

 

LSA Protection

What I am seeing within the Core Isolation is the following

1. Memory Integrity
   
2. Memory Access Protection
   
3. Vulnerable Driver Blocklist
   

Are all of the above parts of the LSA system? If so are all supposed to be toggled on?

Kenneth

 

LSA Protection

My System Information shows that there is the Kernal DMA Protection. Is this taking the place of the LSA?

Kenneth