LSA Restricted Admin Registry Modification

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects registry changes affecting DisableRestrictedAdmin, specifically when it is set to '00000000' (disabled). This modification could weaken authentication protections or facilitate credential theft techniques by allowing the use of cached credentials for remote connections.