LSA package is not signed as expected.

Kol12 · Jul 31, 2022

Event 6155, LSA (LsaSrv)

"LSA package is not signed as expected. This can cause unexpected behavior with Credential Guard."

I have a string of these in Event Viewer. Does anybody know what they mean?

LeLibran · Jul 31, 2022

This might help with narrowing down the cause:

Configuring Additional LSA Protection

Learn how to configure additional protection for the Local Security Authority (LSA) process to prevent code injection that could compromise credentials.

docs.microsoft.com

See the section on "protected process requirements for plug-ins or drivers"

Jacques1945 · Apr 2, 2023

Bonjour
J'ai le même problème sur PC neuf (15 jours) avec processeur AMD Ryzen 5 5600G.
J'ai tout essayé, désactiver Credential Guard et LSA mais toujours ces messages !

SlicEnDicE · Apr 2, 2023

Jacques1945 said:
Bonjour
J'ai le même problème sur PC neuf (15 jours) avec processeur AMD Ryzen 5 5600G.
J'ai tout essayé, désactiver Credential Guard et LSA mais toujours ces messages !

English please. Use Google translate if it is challenging to write directly in English.

TairikuOkami · Apr 2, 2023

Try to apply this code in CMD as admin, 11 is vulnerable by default, so it will be beneficial either way.

Code:

reg add "HKLM\Software\Microsoft\Cryptography\Wintrust\Config" /v "EnableCertPaddingCheck" /t REG_SZ /d "1" /f
reg add "HKLM\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config" /t REG_SZ /d "1" /f
reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v "RunAsPPL" /t REG_DWORD /d "1" /f

10-year-old Windows bug with 'opt-in' fix exploited in 3CX attack

A 10-year-old Windows vulnerability is still being exploited in attacks to make it appear that executables are legitimately signed, with the fix from Microsoft still "opt-in" after all these years. Even worse, the fix is removed after upgrading to Windows 11.

www.bleepingcomputer.com

Brink · Apr 2, 2023

You can use option 2 or 4 below to enable LSA again without getting the warning.

Enable or Disable Local Security Authority (LSA) Protection in Windows 11 Tutorial

This tutorial will show you how to enable or disable Local Security Authority (LSA) protection for all users in Windows 11. Core isolation is a security feature of Microsoft Windows that protects important core processes of Windows from malicious software by isolating them in memory. It does...

www.elevenforum.com

Jacques1945 · Apr 12, 2023

Good morning
I have the same problem on a new PC (20 days) with AMD Ryzen 5 5600G processor, and Windows 11 22H2 22261.1555.
Tried everything, disabling Credential Guard and LSA but still these messages!

Jacques1945 · Apr 16, 2023

SlicEnDicE said:
En anglais s'il vous plaît. Utilisez Google Translate s'il est difficile d'écrire directement en anglais.

Good morning,

I have the same problem on a new PC (20 days) with AMD Ryzen 5 5600G processor and Windows 11 22H2 22261.1555.
I tried everything, disabling Credential Guard and LSA but still these messages!

This morning I even tried to deactivate fTPM, the same thing does not change anything!

Cocokola · May 9, 2023

Jacques1945 said:
Good morning,

I have the same problem on a new PC (20 days) with AMD Ryzen 5 5600G processor and Windows 11 22H2 22261.1555.
I tried everything, disabling Credential Guard and LSA but still these messages!

This morning I even tried to deactivate fTPM, the same thing does not change anything!

any progress?

Jacques1945 · May 10, 2023

No progress, unfortunately. It doesn't stop the PC from working but amd or microsoft should fix the problem.
And you, did you succeed?

LSA package is not signed as expected.

Well-known member

My Computer

Well-known member

My Computers

Member

My Computer

Well-known member

My Computers

Brony

My Computer

Administrator

My Computers

Member

My Computer

Member

My Computer

Member

My Computer

Member

My Computer

Similar threads