windows-ansible/policy_templates/PolicyDefinitions/LocalSecurityAuthority.admx

<?xml version="1.0" encoding="utf-8"?>
<!--  (c) 2006 Microsoft Corporation  -->
<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
  <policyNamespaces>
    <target prefix="localsecurityauthority" namespace="Microsoft.Policies.LocalSecurityAuthority" />
    <using prefix="windows" namespace="Microsoft.Policies.Windows" />
  </policyNamespaces>
  <resources minRequiredRevision="1.0" />
  <categories>
    <category name="LocalSecurityAuthority" displayName="$(string.LocalSecurityAuthority)">
      <parentCategory ref="windows:System" />
    </category>
 </categories>
 <policies>
    <policy name="AllowCustomSSPsAPs" class="Machine" displayName="$(string.AllowCustomSSPsAPs)" explainText="$(string.AllowCustomSSPsAPs_Help)" key="Software\Policies\Microsoft\Windows\System" valueName="AllowCustomSSPsAPs">
      <parentCategory ref="LocalSecurityAuthority" />
      <supportedOn ref="windows:SUPPORTED_Windows_10_0_RS6_NOSERVER" />
      <enabledValue>
        <decimal value="1" />
      </enabledValue>
      <disabledValue>
        <decimal value="0" />
      </disabledValue>
    </policy>
    <policy name="ConfigureLsaProtectedProcess" class="Machine" displayName="$(string.ConfigureLsaProtectedProcess)" explainText="$(string.ConfigureLsaProtectedProcess_Help)" presentation="$(presentation.ConfigureLsaProtectedProcess)" key="System\CurrentControlSet\Control\Lsa">
      <parentCategory ref="LocalSecurityAuthority" />
      <supportedOn ref="windows:SUPPORTED_Windows_10_0_RS6_NOSERVER" />
      <elements>
        <enum id="ConfigureLsaProtectedProcess" valueName="RunAsPPL">
          <item displayName="$(string.ConfigureLsaProtectedProcess_Disabled)">
            <value>
              <decimal value="0" />
            </value>
          </item>
          <item displayName="$(string.ConfigureLsaProtectedProcess_EnabledWithUEFILock)">
            <value>
              <decimal value="1" />
            </value>
          </item>
          <item displayName="$(string.ConfigureLsaProtectedProcess_EnabledWithoutUEFILock)">
            <value>
              <decimal value="2" />
            </value>
          </item>
        </enum>
      </elements>
    </policy>
 </policies>
</policyDefinitions>