LSA package is not signed as expected.


Kol12

Kol12

Well-known member
Member
VIP
Local time
7:34 PM
Posts
340
OS
Windows 11 - Release Preview channel
Event 6155, LSA (LsaSrv)

"LSA package is not signed as expected. This can cause unexpected behavior with Credential Guard."

I have a string of these in Event Viewer. Does anybody know what they mean?
 

My Computer

System One

  • OS
    Windows 11 - Release Preview channel
    Computer type
    PC/Desktop
    Manufacturer/Model
    Kol's custom ROG
    CPU
    Intel 13900K
    Motherboard
    Asus ROG Maximus Hero Z790
    Memory
    Corsair Dominator Platinum RGB 32GB DDR5 6000MHz
    Graphics Card(s)
    Gigabyte 4090 Gaming OC
    Sound Card
    SoundBlaster X-AE5
    Monitor(s) Displays
    Dell Alienware AW3821DW
    Screen Resolution
    3840x1600 144hz
    Hard Drives
    Samsung 980 Pro 500GB
    860 EVO's
    Samsung 990 Pro 2TB
    External RAID enclosure - 2x Seagate 3TB HDD
    PSU
    Seasonic Prime Ultra 1300W Platinum
    Case
    Phanteks Eclipse P600S
    Cooling
    Custom water cooling. EK Velocity (CPU), EK Quantum Vector2 (GPU), EK Quantum D5 Pump, 360mm radiator in case + 560mm external radiator
    Keyboard
    Corsair K100
    Mouse
    Logitech G502X
    Antivirus
    Windows Defender, VBS
This might help with narrowing down the cause:

docs.microsoft.com

Configuring Additional LSA Protection

Learn how to configure additional protection for the Local Security Authority (LSA) process to prevent code injection that could compromise credentials.
docs.microsoft.com

See the section on "protected process requirements for plug-ins or drivers"
 

My Computers

System One System Two

  • OS
    macOS (plus VMs: Windows XP, 7, 10 Home/Pro, 11 Home/Pro, Linux Distros)
    Computer type
    Laptop
    Manufacturer/Model
    a) Apple MacBook Pro (Intel) - 2019 b) Apple MacBook Pro M1 MAX - 2021
    CPU
    a) Intel i9 b) M1 MAX (ARM)
    Memory
    a) 16GB b) 32GB
    Hard Drives
    a) 1TB SSD + 256GB SD Card b) 1TB SSD (+ 1TB SD Card)
    Browser
    a) Safari/Vivaldi/DuckDuckGo b) Safari/DuckDuckGo
    Antivirus
    -
  • Operating System
    Windows 11 Pro (plus VirtualBox VMs: Windows 11 Pro & Linux Distros)
    Computer type
    Laptop
    Manufacturer/Model
    a) Microsoft Surface Book 2, b) HP Spectre X360
    CPU
    a) i7, b) i7
    Memory
    a) 16GB, b) 16GB
    Hard Drives
    a) 1TB SSD, b) 1TB SSD
    Browser
    a) MS Edge, b) MS Edge
    Antivirus
    a) Defender, b) Defender
Bonjour
J'ai le même problème sur PC neuf (15 jours) avec processeur AMD Ryzen 5 5600G.
J'ai tout essayé, désactiver Credential Guard et LSA mais toujours ces messages !
 

My Computer

System One

  • OS
    Windows 11 22H2 22621.1485
    Computer type
    PC/Desktop
    Manufacturer/Model
    PC-GAME VANT PC vendu par Power C
    CPU
    AMD Ryzen 5 5600G
    Motherboard
    GIGABYTE A520M S2H
    Memory
    16 Go DDR4 Silicon Power Computer
    Graphics Card(s)
    Intégré AMD Radeon Vega Cezanne
    Sound Card
    Intégré Realtek ALC1220
    Monitor(s) Displays
    1 Philips 240SW 1920x1200 et 1 Samsung SMS22A4501680 x 1050
    Screen Resolution
    1920 x 1200 et 1680 x 1050
    Hard Drives
    1 SSD CT1000BX500SSD de 1 To
    1 DD Seagate ST2000DM008-2FR102 de 2 To
    PSU
    Alimentation CoolBox FORCE500 certifiée 80Plus Bronze
    Keyboard
    Packard Bell PR 1101U
    Mouse
    Tecurs GM001 2,4 Ghz
    Internet Speed
    ADSL descendant 947 Mb/s Ascendant 614 Mb/s
    Browser
    Plusieurs : Edge, Cent, Google
    Antivirus
    Juste celui de Microsoft
    Other Info
    Pour l'instant à part des avertissements dans l'observateur d'évènement (dont certains résolus) fonctionnement impeccable et très rapide.
Jacques1945 said:
Bonjour
J'ai le même problème sur PC neuf (15 jours) avec processeur AMD Ryzen 5 5600G.
J'ai tout essayé, désactiver Credential Guard et LSA mais toujours ces messages !
Click to expand...
English please. Use Google translate if it is challenging to write directly in English.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 23H2 build 10.0.22631.3296 (Release Channel) / Linux Mint 21.3 Cinnamon
    Computer type
    Laptop
    Manufacturer/Model
    Lenovo A485
    CPU
    Ryzen 7 2700U Pro
    Motherboard
    Lenovo (WiFi/BT module upgraded to Intel Wireless-AC-9260)
    Memory
    32GB
    Graphics Card(s)
    iGPU Vega 10
    Sound Card
    Realtek
    Monitor(s) Displays
    14" FHD (built-in) + 14" Lenovo Thinkvision M14t (touch+pen) + 32" Asus PB328
    Screen Resolution
    FHD + FHD + 1440p
    Hard Drives
    Intel 660p m.2 nVME PCIe3.0 x2 512GB
    PSU
    65W
    Keyboard
    Thinkpad / Logitech MX Keys
    Mouse
    Logitech MX Master 2S
    Internet Speed
    600/300Mbit
    Browser
    Edge (Chromium)
    Antivirus
    Windows Defender
    Other Info
    SecureBoot: Enabled
    TPM2.0: Enabled
    AMD-V: Enabled
  • Operating System
    Windows 11 Pro 23H2 build 10.0.22631.3296(Release Preview Channel)
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom
    CPU
    i7-7700k @4.8GHz
    Motherboard
    Asus PRIME Z270-A
    Memory
    32GB 2x16GB 2133MHz CL15
    Graphics card(s)
    EVGA GTX1080Ti FTW 11GB
    Sound Card
    Integrated
    Monitor(s) Displays
    32" 10-bit Asus PB328Q
    Screen Resolution
    WQHD 2560x1440
    Hard Drives
    512GB ADATA SX8000NP NVMe PCIe Gen 3 x4
    PSU
    850W
    Case
    Fractal Design Define 7
    Cooling
    Noctua NH-D15 chromax.black
    Mouse
    Logitech MX Master 2S
    Keyboard
    Logitech MX Keys
    Internet Speed
    600/300Mbit
    Browser
    Edge (Cromium)
    Antivirus
    Windows Defender
    Other Info
    AC WiFi Card
Try to apply this code in CMD as admin, 11 is vulnerable by default, so it will be beneficial either way.
Code: 
reg add "HKLM\Software\Microsoft\Cryptography\Wintrust\Config" /v "EnableCertPaddingCheck" /t REG_SZ /d "1" /f
reg add "HKLM\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config" /t REG_SZ /d "1" /f
reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v "RunAsPPL" /t REG_DWORD /d "1" /f
www.bleepingcomputer.com

10-year-old Windows bug with 'opt-in' fix exploited in 3CX attack

A 10-year-old Windows vulnerability is still being exploited in attacks to make it appear that executables are legitimately signed, with the fix from Microsoft still "opt-in" after all these years. Even worse, the fix is removed after upgrading to Windows 11.
www.bleepingcomputer.com www.bleepingcomputer.com
 

My Computer

System One

  • OS
    Windows 11 Home
    Computer type
    PC/Desktop
    CPU
    AMD Ryzen 5 3600 & No fTPM (07/19)
    Motherboard
    MSI B450 TOMAHAWK 7C02v1E & IFX TPM (07/19)
    Memory
    4x 8GB ADATA XPG GAMMIX D10 DDR4 3200MHz CL16
    Graphics Card(s)
    MSI Radeon RX 580 ARMOR 8G OC @48FPS (08/19)
    Sound Card
    Creative Sound Blaster Z (11/16)
    Monitor(s) Displays
    24" AOC G2460VQ6 (01/19)
    Screen Resolution
    1920×1080@75Hz & FreeSync (DisplayPort)
    Hard Drives
    ADATA XPG GAMMIX S11 Pro SSD 512GB (07/19)
    PSU
    Seasonic M12II-520 80 Plus Bronze (11/16)
    Case
    Lian Li PC-7NB & 3x Noctua NF-S12A FLX@700rpm (11/16)
    Cooling
    CPU Cooler Noctua NH-U12S@700rpm (07/19)
    Keyboard
    HP Wired Desktop 320K + Rabalux 76017 Parker (01/24)
    Mouse
    Logitech M330 Silent Plus (04/23)
    Internet Speed
    400/40 Mbps via RouterOS (05/21) & TCP Optimizer
    Browser
    Edge (No FB/Google) & Brave for YouTube & LibreWolf for FB
    Antivirus
    NoAV & Binisoft WFC & NextDNS
    Other Info
    Headphones: Sennheiser RS170 (09/10)
    Phone: Samsung Galaxy Xcover 7 (02/24)
You can use option 2 or 4 below to enable LSA again without getting the warning. :alien:

www.elevenforum.com

Enable or Disable Local Security Authority (LSA) Protection in Windows 11 Tutorial

This tutorial will show you how to enable or disable Local Security Authority (LSA) protection for all users in Windows 11. Core isolation is a security feature of Microsoft Windows that protects important core processes of Windows from malicious software by isolating them in memory. It does...
www.elevenforum.com www.elevenforum.com
 

My Computers

System One System Two

  • OS
    Windows 11 Pro for Workstations
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom self build
    CPU
    Intel i7-8700K 5 GHz
    Motherboard
    ASUS ROG Maximus XI Formula Z390
    Memory
    64 GB (4x16GB) G.SKILL TridentZ RGB DDR4 3600 MHz (F4-3600C18D-32GTZR)
    Graphics Card(s)
    ASUS ROG-STRIX-GTX1080TI-O11G-GAMING (11GB GDDR5X)
    Sound Card
    Integrated Digital Audio (S/PDIF)
    Monitor(s) Displays
    2 x Samsung Odyssey G75 27"
    Screen Resolution
    2560x1440
    Hard Drives
    1TB Samsung 990 PRO M.2,
    4TB Samsung 990 PRO M.2,
    8TB WD MyCloudEX2Ultra NAS
    PSU
    Seasonic Prime Titanium 850W
    Case
    Thermaltake Core P3 wall mounted
    Cooling
    Corsair Hydro H115i
    Keyboard
    Logitech wireless K800
    Mouse
    Logitech MX Master 3
    Internet Speed
    1 Gbps Download and 35 Mbps Upload
    Browser
    Google Chrome
    Antivirus
    Microsoft Defender and Malwarebytes Premium
    Other Info
    Logitech Z625 speaker system,
    Logitech BRIO 4K Pro webcam,
    HP Color LaserJet Pro MFP M477fdn,
    APC SMART-UPS RT 1000 XL - SURT1000XLI,
    Galaxy S23 Plus phone
  • Operating System
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    HP Spectre x360 2in1 14-eu0098nr (2024)
    CPU
    Intel Core Ultra 7 155H 4.8 GHz
    Memory
    16 GB LPDDR5x-7467 MHz
    Graphics card(s)
    Integrated Intel Arc
    Sound Card
    Poly Studio
    Monitor(s) Displays
    14" 2.8K OLED multitouch
    Screen Resolution
    2880 x 1800
    Hard Drives
    2 TB PCIe NVMe M.2 SSD
    Internet Speed
    Intel Wi-Fi 7 BE200 (2x2) and Bluetooth 5.4
    Browser
    Chrome and Edge
    Antivirus
    Windows Defender and Malwarebytes Premium
Good morning
I have the same problem on a new PC (20 days) with AMD Ryzen 5 5600G processor, and Windows 11 22H2 22261.1555.
Tried everything, disabling Credential Guard and LSA but still these messages!
 

My Computer

System One

  • OS
    Windows 11 22H2 22621.1485
    Computer type
    PC/Desktop
    Manufacturer/Model
    PC-GAME VANT PC vendu par Power C
    CPU
    AMD Ryzen 5 5600G
    Motherboard
    GIGABYTE A520M S2H
    Memory
    16 Go DDR4 Silicon Power Computer
    Graphics Card(s)
    Intégré AMD Radeon Vega Cezanne
    Sound Card
    Intégré Realtek ALC1220
    Monitor(s) Displays
    1 Philips 240SW 1920x1200 et 1 Samsung SMS22A4501680 x 1050
    Screen Resolution
    1920 x 1200 et 1680 x 1050
    Hard Drives
    1 SSD CT1000BX500SSD de 1 To
    1 DD Seagate ST2000DM008-2FR102 de 2 To
    PSU
    Alimentation CoolBox FORCE500 certifiée 80Plus Bronze
    Keyboard
    Packard Bell PR 1101U
    Mouse
    Tecurs GM001 2,4 Ghz
    Internet Speed
    ADSL descendant 947 Mb/s Ascendant 614 Mb/s
    Browser
    Plusieurs : Edge, Cent, Google
    Antivirus
    Juste celui de Microsoft
    Other Info
    Pour l'instant à part des avertissements dans l'observateur d'évènement (dont certains résolus) fonctionnement impeccable et très rapide.
SlicEnDicE said:
En anglais s'il vous plaît. Utilisez Google Translate s'il est difficile d'écrire directement en anglais.
Click to expand...
Good morning,

I have the same problem on a new PC (20 days) with AMD Ryzen 5 5600G processor and Windows 11 22H2 22261.1555.
I tried everything, disabling Credential Guard and LSA but still these messages!



This morning I even tried to deactivate fTPM, the same thing does not change anything!
 

My Computer

System One

  • OS
    Windows 11 22H2 22621.1485
    Computer type
    PC/Desktop
    Manufacturer/Model
    PC-GAME VANT PC vendu par Power C
    CPU
    AMD Ryzen 5 5600G
    Motherboard
    GIGABYTE A520M S2H
    Memory
    16 Go DDR4 Silicon Power Computer
    Graphics Card(s)
    Intégré AMD Radeon Vega Cezanne
    Sound Card
    Intégré Realtek ALC1220
    Monitor(s) Displays
    1 Philips 240SW 1920x1200 et 1 Samsung SMS22A4501680 x 1050
    Screen Resolution
    1920 x 1200 et 1680 x 1050
    Hard Drives
    1 SSD CT1000BX500SSD de 1 To
    1 DD Seagate ST2000DM008-2FR102 de 2 To
    PSU
    Alimentation CoolBox FORCE500 certifiée 80Plus Bronze
    Keyboard
    Packard Bell PR 1101U
    Mouse
    Tecurs GM001 2,4 Ghz
    Internet Speed
    ADSL descendant 947 Mb/s Ascendant 614 Mb/s
    Browser
    Plusieurs : Edge, Cent, Google
    Antivirus
    Juste celui de Microsoft
    Other Info
    Pour l'instant à part des avertissements dans l'observateur d'évènement (dont certains résolus) fonctionnement impeccable et très rapide.
Jacques1945 said:
Good morning,

I have the same problem on a new PC (20 days) with AMD Ryzen 5 5600G processor and Windows 11 22H2 22261.1555.
I tried everything, disabling Credential Guard and LSA but still these messages!



This morning I even tried to deactivate fTPM, the same thing does not change anything!
Click to expand...
any progress?
 

My Computer

System One

  • OS
    Win12 beta (or slow Win 11)
    Computer type
    PC/Desktop
    Manufacturer/Model
    self build
    CPU
    Ryzen 9 5900X
    Motherboard
    GIGABYTE B550 version 1
    Memory
    DDR4 64GB(32x2) 1300mhz 20-19-19-43-62-1T
    Graphics Card(s)
    NVidea GeForce GTX 1060 6GB
    Screen Resolution
    (2) of 3840x2160
    Hard Drives
    (3) 18TB (4) 9TB 2TB m.2
    PSU
    850W
    Internet Speed
    1 gig
    Browser
    chrome
No progress, unfortunately. It doesn't stop the PC from working but amd or microsoft should fix the problem.
And you, did you succeed?
 

My Computer

System One

  • OS
    Windows 11 22H2 22621.1485
    Computer type
    PC/Desktop
    Manufacturer/Model
    PC-GAME VANT PC vendu par Power C
    CPU
    AMD Ryzen 5 5600G
    Motherboard
    GIGABYTE A520M S2H
    Memory
    16 Go DDR4 Silicon Power Computer
    Graphics Card(s)
    Intégré AMD Radeon Vega Cezanne
    Sound Card
    Intégré Realtek ALC1220
    Monitor(s) Displays
    1 Philips 240SW 1920x1200 et 1 Samsung SMS22A4501680 x 1050
    Screen Resolution
    1920 x 1200 et 1680 x 1050
    Hard Drives
    1 SSD CT1000BX500SSD de 1 To
    1 DD Seagate ST2000DM008-2FR102 de 2 To
    PSU
    Alimentation CoolBox FORCE500 certifiée 80Plus Bronze
    Keyboard
    Packard Bell PR 1101U
    Mouse
    Tecurs GM001 2,4 Ghz
    Internet Speed
    ADSL descendant 947 Mb/s Ascendant 614 Mb/s
    Browser
    Plusieurs : Edge, Cent, Google
    Antivirus
    Juste celui de Microsoft
    Other Info
    Pour l'instant à part des avertissements dans l'observateur d'évènement (dont certains résolus) fonctionnement impeccable et très rapide.
You must log in or register to reply here.

Similar threads

"LSA package is not signed as expected" -- Yes, again.
Replies
3
Views
3K
STRESSED
STRESSED
Credential Guard is configured to run, but is not licensed - Windows 11 Pro
Replies
14
Views
4K
Dru2
Dru2
LSA Credential Guard Errors in Event Log
Replies
6
Views
16K
vis
V
Is LSA no longer enabled by default?
Replies
6
Views
3K
Ulqi
U
  • Article
Privacy and Security Verify Local Security Authority (LSA) Protection in Windows 11
Replies
0
Views
927
Brink
Brink

Latest Support Threads

Latest Tutorials

Back
Top Bottom