LSA Credential Guard Errors in Event Log


thecaretaker

Well-known member
Member
VIP
Local time
7:15 AM
Posts
167
Location
1066 Country, UK
OS
Windows 11 Pro Version 23H2 OS Build 22631.3374
Can somebody help me? Everytime I boot up my new install of Windows 11 Pro I am getting the following errors in event log.

Screenshot 2023-04-01 123454.png

The details are as follows:

Error ID: 6155
LSA package is not signed as expected. This can cause unexpected behaviour with Credential Guard.

PackageName: schannel
PackageName: wdigest
PackageName: cloudap
PackageName: pku2u
PackageName: tspkg
PackageName: msv1_0
PackageName: kerberos
PackageName: negoexts


Error ID: 6147
Credential Guard is configured to run, but is not licensed. Credential Guard was not started.

Error ID: 28
Error setting traits on Provider {77811378-e885-4ac2-a580-bc86e4f1bc93}. Error: 0xC0000005

Error ID: 56
The description for Event ID 56 from source Application Popup cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

ACPI
2

The message resource is present but the message was not found in the message table

I have never used Credential Guard, I don't even know what it is. I've searched everywhere on the internet and as far as I can see, it is not turned on as Error 6147 says. I don't know if Error 56 and 28 are connected to the LSA errors or not. I am sure I didn't have these errors when the shop built this PC, they seem fairly recent.

My Windows 11 Pro runs perfectly, no BSD.

Screenshot 2023-04-01 125301.png

I have read other posts about this LSA which as far as I understand shouldn't be running on a home system. I did see a post on these forums with some options 1,2 and 4, but my knowledge is extremely limited and just don't understand what they are saying. Is this the same issue the options refer to? Is it a Microsoft issue and will it get fixed with a Windows Update? Should I carry on just ignoring it or could it potentially be dangerous. I'm so confused with all the different things I've read.
 

My Computer

System One

  • OS
    Windows 11 Pro Version 23H2 OS Build 22631.3374
    Computer type
    PC/Desktop
    Manufacturer/Model
    Local shop built (KC Computers Ltd)
    CPU
    Intel Core i9 13900F
    Motherboard
    Gigabyte Z690 Gaming X (rev. 1.0/1.1) - (BIOS: F29 Dec 22, 2023)
    Memory
    2 x Kingston Fury 32gb DDR5 5600 Beast
    Graphics Card(s)
    Gigabyte Eagle (Nvidia) RTX 3060
    Sound Card
    Chord Async USB 44.1kHz - 384kHz 2Qute DAC
    Monitor(s) Displays
    piXL PX27UDH4K 27 Inch Frameless IPS Monitor
    Screen Resolution
    4K (3840 x 2160) 60fps
    Hard Drives
    1 x KINGSTON NVMe M.2 SSDSKC3000D2048G 2TB
    1 x Samsung SSD 870 EVO 250GB
    2 x Crucial CT4000MX500SSD1 4TB
    2 x Crucial CT2000MX500SSD1 2TB
    1 x Crucial CT250MX500SSD1 250.0 GB
    PSU
    Gigabyte 750w
    Case
    Fractal Torrent
    Cooling
    Stock Intel CPU, 2 x Fractal 180mm PWM (front), 3 x Fractal 140mm PWM (bottom)
    Keyboard
    Logitech MX Mechanical Wireless Illuminated Performance Keyboard
    Mouse
    Logitech MX Master 3S Wireless Performance Mouse
    Internet Speed
    960 Mbps/330 Mbps Trooli FTTP
    Browser
    Firefox
    Antivirus
    Eset Nod32
Those are warnings, not errors. Event IDs 26 & 56 are.

"If you are seeing LSA warnings for packages negoexts, kerberos, msv1_0, tspkg, pku2u, cloudap, wdigest, schannel, sfapm - it looks like you can ignore those, because they are related to password-based SSO, according to this. These specific warnings (they are not errors in the event viewer!) only indicate that something tried loading one of the affected protocols or it was just the general attempt to load the library. According to MS article, this only blocks SSO, not the whole protocols.

It is clear, that for these particular instances it would warrant Microsoft to write a more appropriate warning text, perhaps also indicating what was calling the library or whether it was a general load of the library during boot-up sequence."

From: Redirecting
 

My Computers

System One System Two

  • OS
    Win11 All /Debian/Arch
    Computer type
    Laptop
    Manufacturer/Model
    ASUSTeK COMPUTER INC. TUF Gaming FX705GM
    CPU
    2.20 gigahertz Intel i7-8750H Hyper-threaded 12 cores
    Motherboard
    ASUSTeK COMPUTER INC. FX705GM 1.0
    Memory
    24428 Megabytes
    Graphics Card(s)
    Intel(R) UHD Graphics 630 / NVIDIA GeForce GTX 1060
    Sound Card
    Intel(R) Display Audio / Realtek(R) Audio
    Monitor(s) Displays
    Integrated Monitor (17.3"vis)
    Screen Resolution
    FHD 1920X1080 16:9
    Hard Drives
    2 SSD SATA/NVM Express 1.3
    WDS500G2B0A-00SM50 500.1 GB
    WDCSDAPNUW-1002 256 GB
    PSU
    19V DC 6.32 A 120 W
    Cooling
    Dual Fans
    Mouse
    MS Bluetooth
    Internet Speed
    Fiber 1GB Cox -us & ADSL Bouygues -fr
    Browser
    Edge Canary- Firefox Nightly
    Antivirus
    Windows Defender
    Other Info
    VMs of Windows 11 stable/Beta/Dev/Canary
    VM of XeroLinux- Arch based & Debian 12
  • Operating System
    Windows 11 Insider Canary
    Computer type
    Laptop
    Manufacturer/Model
    ASUS X751BP
    CPU
    AMD Dual Core A6-9220
    Motherboard
    ASUS
    Memory
    8 GB
    Graphics card(s)
    AMD Radeon R5 M420
    Sound Card
    Realtek
    Monitor(s) Displays
    17.3
    Screen Resolution
    1600X900 16:9
    Hard Drives
    1TB 5400RPM
Those are warnings, not errors. Event IDs 26 & 56 are.

"If you are seeing LSA warnings for packages negoexts, kerberos, msv1_0, tspkg, pku2u, cloudap, wdigest, schannel, sfapm - it looks like you can ignore those, because they are related to password-based SSO, according to this. These specific warnings (they are not errors in the event viewer!) only indicate that something tried loading one of the affected protocols or it was just the general attempt to load the library. According to MS article, this only blocks SSO, not the whole protocols.

It is clear, that for these particular instances it would warrant Microsoft to write a more appropriate warning text, perhaps also indicating what was calling the library or whether it was a general load of the library during boot-up sequence."

From: Redirecting

Thanks, I'll continue to ignore them then. I'm sure I never had the warnings when the PC was new. I don't know why they have recently started showing. I sometimes wish I had never discovered the event log :giggle:
 

My Computer

System One

  • OS
    Windows 11 Pro Version 23H2 OS Build 22631.3374
    Computer type
    PC/Desktop
    Manufacturer/Model
    Local shop built (KC Computers Ltd)
    CPU
    Intel Core i9 13900F
    Motherboard
    Gigabyte Z690 Gaming X (rev. 1.0/1.1) - (BIOS: F29 Dec 22, 2023)
    Memory
    2 x Kingston Fury 32gb DDR5 5600 Beast
    Graphics Card(s)
    Gigabyte Eagle (Nvidia) RTX 3060
    Sound Card
    Chord Async USB 44.1kHz - 384kHz 2Qute DAC
    Monitor(s) Displays
    piXL PX27UDH4K 27 Inch Frameless IPS Monitor
    Screen Resolution
    4K (3840 x 2160) 60fps
    Hard Drives
    1 x KINGSTON NVMe M.2 SSDSKC3000D2048G 2TB
    1 x Samsung SSD 870 EVO 250GB
    2 x Crucial CT4000MX500SSD1 4TB
    2 x Crucial CT2000MX500SSD1 2TB
    1 x Crucial CT250MX500SSD1 250.0 GB
    PSU
    Gigabyte 750w
    Case
    Fractal Torrent
    Cooling
    Stock Intel CPU, 2 x Fractal 180mm PWM (front), 3 x Fractal 140mm PWM (bottom)
    Keyboard
    Logitech MX Mechanical Wireless Illuminated Performance Keyboard
    Mouse
    Logitech MX Master 3S Wireless Performance Mouse
    Internet Speed
    960 Mbps/330 Mbps Trooli FTTP
    Browser
    Firefox
    Antivirus
    Eset Nod32
  • Like
Reactions: OAT
Can somebody help me? Everytime I boot up my new install of Windows 11 Pro I am getting the following errors in event log.

View attachment 56885

The details are as follows:

Error ID: 6155
LSA package is not signed as expected. This can cause unexpected behaviour with Credential Guard.

PackageName: schannel
PackageName: wdigest
PackageName: cloudap
PackageName: pku2u
PackageName: tspkg
PackageName: msv1_0
PackageName: kerberos
PackageName: negoexts


Error ID: 6147
Credential Guard is configured to run, but is not licensed. Credential Guard was not started.

Error ID: 28
Error setting traits on Provider {77811378-e885-4ac2-a580-bc86e4f1bc93}. Error: 0xC0000005

Error ID: 56
The description for Event ID 56 from source Application Popup cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

ACPI
2

The message resource is present but the message was not found in the message table

I have never used Credential Guard, I don't even know what it is. I've searched everywhere on the internet and as far as I can see, it is not turned on as Error 6147 says. I don't know if Error 56 and 28 are connected to the LSA errors or not. I am sure I didn't have these errors when the shop built this PC, they seem fairly recent.

My Windows 11 Pro runs perfectly, no BSD.

View attachment 56886

I have read other posts about this LSA which as far as I understand shouldn't be running on a home system. I did see a post on these forums with some options 1,2 and 4, but my knowledge is extremely limited and just don't understand what they are saying. Is this the same issue the options refer to? Is it a Microsoft issue and will it get fixed with a Windows Update? Should I carry on just ignoring it or could it potentially be dangerous. I'm so confused with all the different things I've read.
I get the same error ID 28 on a new installation for the same Provider 77811378-e885-4ac2-a580-bc86e4f1bc93. That string doesn't appear in the Registry so it's a mystery.
 

My Computer

System One

  • OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    Self build
    CPU
    Core i7-13700K
    Motherboard
    Asus TUF Gaming Plus WiFi Z790
    Memory
    64 GB Kingston Fury Beast DDR5
    Graphics Card(s)
    Gigabyte GeForce RTX 2060 Super Gaming OC 8G
    Sound Card
    Realtek S1200A
    Monitor(s) Displays
    Viewsonic VP2770
    Screen Resolution
    2560 x 1440
    Hard Drives
    Kingston KC3000 2TB NVME SSD & SATA HDDs & SSD
    PSU
    EVGA SuperNova G2 850W
    Case
    Nanoxia Deep Silence 1
    Cooling
    Noctua NH-D14
    Keyboard
    Microsoft Digital Media Pro
    Mouse
    Logitech Wireless
    Internet Speed
    50 Mb / s
    Browser
    Chrome
    Antivirus
    Defender
You can ignore those (as the majority do - without any issue whatsoever) . If it's a home PC - that is. I'd be more concerned with the Errors below the LSA Warnings. Tho, maybe it's just something you did.
 

My Computer

System One

  • OS
    Windows 7 SP 16 (or Windows 11 SP 2 or Sun Valley 2)
    Computer type
    Laptop
    CPU
    Intel & AMD
    Memory
    SO-DIMM SK Hynix 15.8 GB Dual-Channel DDR4-2666 (2 x 8 GB) 1329MHz (19-19-19-43)
    Graphics Card(s)
    nVidia RTX 2060 6GB Mobile GPU (TU106M)
    Sound Card
    Onbord Realtek ALC1220
    Screen Resolution
    1920 x 1080
    Hard Drives
    1x Samsung PM981 NVMe PCIe M.2 512GB / 1x Seagate Expansion ST1000LM035 1TB
If you really want to remove the LSA warnings from event viewer then you can hide them with this reg hack.
 

Attachments

  • Document_20230524_0001.jpg
    Document_20230524_0001.jpg
    247.8 KB · Views: 24

My Computers

System One System Two

  • OS
    Win 11 64x Pro 23H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    User Built
    CPU
    i9 13900K
    Motherboard
    Rog Strix Z790-F
    Memory
    Corsair Vengeance DDR5 96GB
    Graphics Card(s)
    MSI RTX 3070Ti OC
    Sound Card
    DAC via onboard sound chip
    Monitor(s) Displays
    Eizo 32" FlexScan 4K / LG 43" 4K
    Screen Resolution
    3840x2160 /3840x 2160
    Hard Drives
    1x 990 Pro1TB Nvme 1x 990 Pro 2TB 1x 990 Pro 4 TB
    PSU
    Evga 750 Watt P5
    Case
    Corsair 500D
    Cooling
    Noctua D15 Cromax
    Keyboard
    Cherry G80-3000N
    Mouse
    Corsair
    Internet Speed
    500Mbps
    Browser
    Firefox x64
    Antivirus
    Eset Smart Securty
    Other Info
    Backup software MR ver 8 to Samsung T7
  • Operating System
    Win 11 Pro 23H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    User Built
    CPU
    i9 9900K
    Motherboard
    Asus Hero XI
    Memory
    GSkill 3600 32GB
    Graphics card(s)
    EVA 1060
    Sound Card
    Onboard
    Monitor(s) Displays
    Eizo 32inch 4K
    Screen Resolution
    3840x2160
    Hard Drives
    Samsung 970 Evo Plus 1TB x3
    PSU
    Corsair AX750
    Case
    Corsair 400d
    Cooling
    Noctua 14s
Code:
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{199FE037-2B82-40A9-82AC-E1D46C792B99}
Set REG_DWORD Enabled to 0
 

My Computer

System One

  • OS
    Win11
    Computer type
    PC/Desktop
    Manufacturer/Model
    HP
    CPU
    i7 12700
    Memory
    32 GB DDR5
    Graphics Card(s)
    nVidia A2000 12 GB
    Screen Resolution
    2560x1440
Back
Top Bottom