LSA Credential Guard Errors in Event Log


thecaretaker

Member
Local time
8:41 PM
Posts
19
Visit site
OS
Windows 11 Pro
Can somebody help me? Everytime I boot up my new install of Windows 11 Pro I am getting the following errors in event log.

Screenshot 2023-04-01 123454.png

The details are as follows:

Error ID: 6155
LSA package is not signed as expected. This can cause unexpected behaviour with Credential Guard.

PackageName: schannel
PackageName: wdigest
PackageName: cloudap
PackageName: pku2u
PackageName: tspkg
PackageName: msv1_0
PackageName: kerberos
PackageName: negoexts


Error ID: 6147
Credential Guard is configured to run, but is not licensed. Credential Guard was not started.

Error ID: 28
Error setting traits on Provider {77811378-e885-4ac2-a580-bc86e4f1bc93}. Error: 0xC0000005

Error ID: 56
The description for Event ID 56 from source Application Popup cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

ACPI
2

The message resource is present but the message was not found in the message table

I have never used Credential Guard, I don't even know what it is. I've searched everywhere on the internet and as far as I can see, it is not turned on as Error 6147 says. I don't know if Error 56 and 28 are connected to the LSA errors or not. I am sure I didn't have these errors when the shop built this PC, they seem fairly recent.

My Windows 11 Pro runs perfectly, no BSD.

Screenshot 2023-04-01 125301.png

I have read other posts about this LSA which as far as I understand shouldn't be running on a home system. I did see a post on these forums with some options 1,2 and 4, but my knowledge is extremely limited and just don't understand what they are saying. Is this the same issue the options refer to? Is it a Microsoft issue and will it get fixed with a Windows Update? Should I carry on just ignoring it or could it potentially be dangerous. I'm so confused with all the different things I've read.
 

My Computer

System One

  • OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    Local shop built (KC Computers Ltd)
    CPU
    Intel Core i9 13900F
    Motherboard
    Gigabyte Z690 Gaming X
    Memory
    2 x Kingston Fury 32gb DDR5 5600 Beast
    Graphics Card(s)
    Gigabyte Eagle (Nvidia) RTX 3060
    Sound Card
    Chord Async USB 44.1kHz - 384kHz 2Qute DAC
    Monitor(s) Displays
    piXL PX27UDH4K 27 Inch Frameless IPS Monitor
    Screen Resolution
    4K (3840 x 2160) 60fps
    Hard Drives
    1 x KINGSTON SKC3000D2048G 2TB
    2 x Samsung SSD 870 EVO 250GB
    2 x Crucial CT2000MX500SSD1 2TB
    1 x Crucial CT250MX500SSD1 250.0 GB
    PSU
    Gigabyte 750w
    Case
    Fractal Torrent
    Cooling
    Stock Intel CPU, 2 x Fractal 180mm PWM (front), 3 x Fractal 140mm PWM (bottom), 1 x Corsair 140mm (Rear)
    Keyboard
    Logi H295
    Mouse
    Logi M720
    Internet Speed
    47.2 Mbps
    Browser
    Firefox
    Antivirus
    Eset Nod32
Those are warnings, not errors. Event IDs 26 & 56 are.

"If you are seeing LSA warnings for packages negoexts, kerberos, msv1_0, tspkg, pku2u, cloudap, wdigest, schannel, sfapm - it looks like you can ignore those, because they are related to password-based SSO, according to this. These specific warnings (they are not errors in the event viewer!) only indicate that something tried loading one of the affected protocols or it was just the general attempt to load the library. According to MS article, this only blocks SSO, not the whole protocols.

It is clear, that for these particular instances it would warrant Microsoft to write a more appropriate warning text, perhaps also indicating what was calling the library or whether it was a general load of the library during boot-up sequence."

From: Redirecting
 

My Computers

System One System Two

  • OS
    Canary Channel / XeroLinux
    Computer type
    Laptop
    Manufacturer/Model
    ASUSTeK COMPUTER INC. TUF Gaming FX705GM
    CPU
    2.20 gigahertz Intel i7-8750H Hyper-threaded 12 cores
    Motherboard
    ASUSTeK COMPUTER INC. FX705GM 1.0
    Memory
    24428 Megabytes
    Graphics Card(s)
    Intel(R) UHD Graphics 630 / NVIDIA GeForce GTX 1060
    Sound Card
    Intel(R) Display Audio / Realtek(R) Audio
    Monitor(s) Displays
    Integrated Monitor (17.3"vis)
    Screen Resolution
    FHD 1920X1080 16:9
    Hard Drives
    2 SSD SATA/NVM Express 1.3
    WDS500G2B0A-00SM50 500.1 GB
    WDCSDAPNUW-1002 256 GB
    PSU
    19V DC 6.32 A 120 W
    Cooling
    Dual Fans
    Keyboard
    AZERTY
    Mouse
    MS Bluetooth
    Internet Speed
    Fiber 1GB Cox -us & ADSL Bouygues -fr
    Browser
    Edge Canary- Firefox Nightly
    Antivirus
    Windows Defender
    Other Info
    VMs of Windows 11 stable/Beta/Dev
  • Operating System
    Windows 11 Insider Beta
    Computer type
    Laptop
    Manufacturer/Model
    ASUS X751BP
    CPU
    AMD Dual Core A6-9220
    Motherboard
    ASUS
    Memory
    8 GB
    Graphics card(s)
    AMD Radeon R5 M420
    Sound Card
    Realtek
    Monitor(s) Displays
    17.3
    Screen Resolution
    1600X900 16:9
    Hard Drives
    1TB 5400RPM
Those are warnings, not errors. Event IDs 26 & 56 are.

"If you are seeing LSA warnings for packages negoexts, kerberos, msv1_0, tspkg, pku2u, cloudap, wdigest, schannel, sfapm - it looks like you can ignore those, because they are related to password-based SSO, according to this. These specific warnings (they are not errors in the event viewer!) only indicate that something tried loading one of the affected protocols or it was just the general attempt to load the library. According to MS article, this only blocks SSO, not the whole protocols.

It is clear, that for these particular instances it would warrant Microsoft to write a more appropriate warning text, perhaps also indicating what was calling the library or whether it was a general load of the library during boot-up sequence."

From: Redirecting

Thanks, I'll continue to ignore them then. I'm sure I never had the warnings when the PC was new. I don't know why they have recently started showing. I sometimes wish I had never discovered the event log :giggle:
 

My Computer

System One

  • OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    Local shop built (KC Computers Ltd)
    CPU
    Intel Core i9 13900F
    Motherboard
    Gigabyte Z690 Gaming X
    Memory
    2 x Kingston Fury 32gb DDR5 5600 Beast
    Graphics Card(s)
    Gigabyte Eagle (Nvidia) RTX 3060
    Sound Card
    Chord Async USB 44.1kHz - 384kHz 2Qute DAC
    Monitor(s) Displays
    piXL PX27UDH4K 27 Inch Frameless IPS Monitor
    Screen Resolution
    4K (3840 x 2160) 60fps
    Hard Drives
    1 x KINGSTON SKC3000D2048G 2TB
    2 x Samsung SSD 870 EVO 250GB
    2 x Crucial CT2000MX500SSD1 2TB
    1 x Crucial CT250MX500SSD1 250.0 GB
    PSU
    Gigabyte 750w
    Case
    Fractal Torrent
    Cooling
    Stock Intel CPU, 2 x Fractal 180mm PWM (front), 3 x Fractal 140mm PWM (bottom), 1 x Corsair 140mm (Rear)
    Keyboard
    Logi H295
    Mouse
    Logi M720
    Internet Speed
    47.2 Mbps
    Browser
    Firefox
    Antivirus
    Eset Nod32
  • Like
Reactions: OAT
Can somebody help me? Everytime I boot up my new install of Windows 11 Pro I am getting the following errors in event log.

View attachment 56885

The details are as follows:

Error ID: 6155
LSA package is not signed as expected. This can cause unexpected behaviour with Credential Guard.

PackageName: schannel
PackageName: wdigest
PackageName: cloudap
PackageName: pku2u
PackageName: tspkg
PackageName: msv1_0
PackageName: kerberos
PackageName: negoexts


Error ID: 6147
Credential Guard is configured to run, but is not licensed. Credential Guard was not started.

Error ID: 28
Error setting traits on Provider {77811378-e885-4ac2-a580-bc86e4f1bc93}. Error: 0xC0000005

Error ID: 56
The description for Event ID 56 from source Application Popup cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

ACPI
2

The message resource is present but the message was not found in the message table

I have never used Credential Guard, I don't even know what it is. I've searched everywhere on the internet and as far as I can see, it is not turned on as Error 6147 says. I don't know if Error 56 and 28 are connected to the LSA errors or not. I am sure I didn't have these errors when the shop built this PC, they seem fairly recent.

My Windows 11 Pro runs perfectly, no BSD.

View attachment 56886

I have read other posts about this LSA which as far as I understand shouldn't be running on a home system. I did see a post on these forums with some options 1,2 and 4, but my knowledge is extremely limited and just don't understand what they are saying. Is this the same issue the options refer to? Is it a Microsoft issue and will it get fixed with a Windows Update? Should I carry on just ignoring it or could it potentially be dangerous. I'm so confused with all the different things I've read.
I get the same error ID 28 on a new installation for the same Provider 77811378-e885-4ac2-a580-bc86e4f1bc93. That string doesn't appear in the Registry so it's a mystery.
 

My Computer

System One

  • OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    CPU
    Core i7-13700K
    Motherboard
    Asus TUF Gaming Plus WiFi Z790
    Memory
    64 GB Kingston Fury Beast DDR5
    Graphics Card(s)
    Gigabyte GeForce RTX 2060 Super Gaming OC 8G
    Sound Card
    Realtek S1200A
    Monitor(s) Displays
    Viewsonic VP2770
    Screen Resolution
    2560 x 1440
    Hard Drives
    Kingston KC3000 2TB NVME SSD & SATA HDDs & SSD
    PSU
    EVGA SuperNova G2 850W
    Case
    Nanoxia Deep Silence 1
    Cooling
    Noctua NH-D14
    Keyboard
    Microsoft Digital Media Pro
    Mouse
    Logitech Wireless
    Internet Speed
    15 Mb / s
    Browser
    Chrome
    Antivirus
    Defender
You can ignore those (as the majority do - without any issue whatsoever) . If it's a home PC - that is. I'd be more concerned with the Errors below the LSA Warnings. Tho, maybe it's just something you did.
 

My Computer

System One

  • OS
    Windows 7 SP 16 (or Windows 11 SP 2 or Sun Valley 2)
    Computer type
    Laptop
    CPU
    Intel & AMD
    Memory
    SO-DIMM SK Hynix 15.8 GB Dual-Channel DDR4-2666 (2 x 8 GB) 1329MHz (19-19-19-43)
    Graphics Card(s)
    nVidia RTX 2060 6GB Mobile GPU (TU106M)
    Sound Card
    Onbord Realtek ALC1220
    Screen Resolution
    1920 x 1080
    Hard Drives
    1x Samsung PM981 NVMe PCIe M.2 512GB / 1x Seagate Expansion ST1000LM035 1TB
If you really want to remove the LSA warnings from event viewer then you can hide them with this reg hack.
 

Attachments

  • Document_20230524_0001.jpg
    Document_20230524_0001.jpg
    247.8 KB · Views: 1

My Computers

System One System Two

  • OS
    Win 11 64x Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    User Built
    CPU
    9900KF
    Motherboard
    Rog Hero XI
    Memory
    Gskill 32 GB
    Graphics Card(s)
    MSI RTX 3070Ti OC
    Sound Card
    DAC via onboard sound chip
    Monitor(s) Displays
    Eizo 32" FlexScan 4K / LG 43" 4K
    Screen Resolution
    3840x2160 /3840x 2160
    Hard Drives
    2x Evo Plus970 1GB Nvme 1x Evo Plus 2TB
    PSU
    Evga 750 Watt P5
    Case
    Corsair 500D
    Cooling
    Noctua 14s
    Keyboard
    Cherry MX6
    Mouse
    Corsair
    Internet Speed
    350Mbps
    Browser
    Firefox x64
    Antivirus
    Eset Smart Securty
    Other Info
    Backup software MR ver 8 to Samsung T7
  • Operating System
    Win 10 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    User Built
    CPU
    i7 7700K
    Motherboard
    Asus Hero IX
    Memory
    Corsair LPX 2400
    Graphics card(s)
    MSI 3050
    Sound Card
    Onboard
    Monitor(s) Displays
    Dell U2719D
    Screen Resolution
    2560x1440
    Hard Drives
    Samsung 970 Evo Plus 500GB
    PSU
    Corsair AX750
    Case
    Corsair 400d
    Cooling
    Noctua 14s
Back
Top Bottom