LSA package is not signed as expected.


Kol12

Kol12

Well-known member
Member
VIP
Local time
11:59 PM
Posts
342
OS
Windows 11 - Release Preview channel
Event 6155, LSA (LsaSrv)

"LSA package is not signed as expected. This can cause unexpected behavior with Credential Guard."

I have a string of these in Event Viewer. Does anybody know what they mean?
 

My Computer My Computer

At a glance

Windows 11 - Release Preview channelIntel 13900KCorsair Dominator Platinum RGB 32GB DDR5 6000MHzGigabyte 4090 Gaming OC
OS
Windows 11 - Release Preview channel
Computer type
PC/Desktop
Manufacturer/Model
Kol's custom ROG
CPU
Intel 13900K
Motherboard
Asus ROG Maximus Hero Z790
Memory
Corsair Dominator Platinum RGB 32GB DDR5 6000MHz
Graphics Card(s)
Gigabyte 4090 Gaming OC
Sound Card
SoundBlaster X-AE5
Monitor(s) Displays
Dell Alienware AW3821DW
Screen Resolution
3840x1600 144hz
Hard Drives
Samsung 980 Pro 500GB
860 EVO's
Samsung 990 Pro 2TB
External RAID enclosure - 2x Seagate 3TB HDD
PSU
Seasonic Prime Ultra 1300W Platinum
Case
Phanteks Eclipse P600S
Cooling
Custom water cooling. EK Velocity (CPU), EK Quantum Vector2 (GPU), EK Quantum D5 Pump, 360mm radiator in case + 560mm external radiator
Keyboard
Corsair K100
Mouse
Logitech G502X
Antivirus
Windows Defender, VBS
This might help with narrowing down the cause:

docs.microsoft.com

Configuring Additional LSA Protection

Learn how to configure additional protection for the Local Security Authority (LSA) process to prevent code injection that could compromise credentials.
docs.microsoft.com

See the section on "protected process requirements for plug-ins or drivers"
 

My Computers My Computers

System One System Two

  • At a glance

    macOS 14.x (plus Windows 11, Debian, FreeBSD ...Apple M1 Max (T6001) - 8 performance 2 effici...32GB LPDDR5Apple M1 Max (32-core)
    OS
    macOS 14.x (plus Windows 11, Debian, FreeBSD for ARM64)
    Computer type
    Laptop
    Manufacturer/Model
    MacBook Pro M1 MAX
    CPU
    Apple M1 Max (T6001) - 8 performance 2 efficiency cores
    Memory
    32GB LPDDR5
    Graphics Card(s)
    Apple M1 Max (32-core)
    Hard Drives
    a) 1TB SSD + + 1TB SD Card + external SSD Drives
    Browser
    1. Safari 2. DuckDuckGo
    Antivirus
    -

  • At a glance

    Windows 11 Pro, plus VirtualBox VMs: various ...i732GB
    Operating System
    Windows 11 Pro, plus VirtualBox VMs: various Windows & Linux
    Computer type
    Laptop
    Manufacturer/Model
    Microsoft Surface Laptop Studio
    CPU
    i7
    Memory
    32GB
    Hard Drives
    1TB SSD, plus external SSDs for Virtual Machines etc.
    Browser
    1. MS Edge 2. DuckDuckGo
    Antivirus
    Defender
Bonjour
J'ai le même problème sur PC neuf (15 jours) avec processeur AMD Ryzen 5 5600G.
J'ai tout essayé, désactiver Credential Guard et LSA mais toujours ces messages !
 

My Computer My Computer

At a glance

Windows 11 22H2 22621.1485AMD Ryzen 5 5600G16 Go DDR4 Silicon Power ComputerIntégré AMD Radeon Vega Cezanne
OS
Windows 11 22H2 22621.1485
Computer type
PC/Desktop
Manufacturer/Model
PC-GAME VANT PC vendu par Power C
CPU
AMD Ryzen 5 5600G
Motherboard
GIGABYTE A520M S2H
Memory
16 Go DDR4 Silicon Power Computer
Graphics Card(s)
Intégré AMD Radeon Vega Cezanne
Sound Card
Intégré Realtek ALC1220
Monitor(s) Displays
1 Philips 240SW 1920x1200 et 1 Samsung SMS22A4501680 x 1050
Screen Resolution
1920 x 1200 et 1680 x 1050
Hard Drives
1 SSD CT1000BX500SSD de 1 To
1 DD Seagate ST2000DM008-2FR102 de 2 To
PSU
Alimentation CoolBox FORCE500 certifiée 80Plus Bronze
Keyboard
Packard Bell PR 1101U
Mouse
Tecurs GM001 2,4 Ghz
Internet Speed
ADSL descendant 947 Mb/s Ascendant 614 Mb/s
Browser
Plusieurs : Edge, Cent, Google
Antivirus
Juste celui de Microsoft
Other Info
Pour l'instant à part des avertissements dans l'observateur d'évènement (dont certains résolus) fonctionnement impeccable et très rapide.
Jacques1945 said:
Bonjour
J'ai le même problème sur PC neuf (15 jours) avec processeur AMD Ryzen 5 5600G.
J'ai tout essayé, désactiver Credential Guard et LSA mais toujours ces messages !
Click to expand...
English please. Use Google translate if it is challenging to write directly in English.
 

My Computers My Computers

System One System Two

  • At a glance

    Win 11 Pro 25H2 26200.8457 / Linux Mint 22.3Ryzen 7 2700U Pro32GBiGPU Vega 10
    OS
    Win 11 Pro 25H2 26200.8457 / Linux Mint 22.3
    Computer type
    Laptop
    Manufacturer/Model
    Lenovo A485
    CPU
    Ryzen 7 2700U Pro
    Motherboard
    Lenovo (WiFi/BT module upgraded to Intel Wireless-AC-9260)
    Memory
    32GB
    Graphics Card(s)
    iGPU Vega 10
    Sound Card
    Realtek
    Monitor(s) Displays
    14" FHD (built-in) + 14" Lenovo Thinkvision M14t (touch+pen) + 32" Asus PB328
    Screen Resolution
    FHD + FHD + 1440p
    Hard Drives
    Intel 660p m.2 nVME PCIe3.0 x2 512GB
    PSU
    125W(Dock)/65W(Travel Adapter)
    Keyboard
    Thinkpad / Logitech MX Keys
    Mouse
    Logitech MX Master 2S
    Internet Speed
    1/1Gbit
    Browser
    Firefox
    Antivirus
    Windows Defender
    Other Info
    SecureBoot: Enabled
    TPM2.0: Enabled
    AMD-V: Enabled

  • At a glance

    Win 11 Pro 25H2 26200.8521(RP)i7-7700k @4.8GHz32GB 2x16GB 2133MHz CL15EVGA GTX1080Ti FTW 11GB
    Operating System
    Win 11 Pro 25H2 26200.8521(RP)
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom
    CPU
    i7-7700k @4.8GHz
    Motherboard
    Asus PRIME Z270-A
    Memory
    32GB 2x16GB 2133MHz CL15
    Graphics card(s)
    EVGA GTX1080Ti FTW 11GB
    Sound Card
    Integrated
    Monitor(s) Displays
    32" 10-bit Asus PB328Q
    Screen Resolution
    WQHD 2560x1440
    Hard Drives
    512GB ADATA SX8000NP NVMe PCIe Gen 3 x4
    PSU
    850W
    Case
    Fractal Design Define 7
    Cooling
    Noctua NH-D15 chromax.black
    Keyboard
    Logitech MX Keys
    Mouse
    Logitech MX Master 2S
    Internet Speed
    1/1Gbit
    Browser
    Firefox
    Antivirus
    Windows Defender
    Other Info
    AC WiFi Card
Try to apply this code in CMD as admin, 11 is vulnerable by default, so it will be beneficial either way.
Code: 
reg add "HKLM\Software\Microsoft\Cryptography\Wintrust\Config" /v "EnableCertPaddingCheck" /t REG_SZ /d "1" /f
reg add "HKLM\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config" /t REG_SZ /d "1" /f
reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v "RunAsPPL" /t REG_DWORD /d "1" /f
www.bleepingcomputer.com

10-year-old Windows bug with 'opt-in' fix exploited in 3CX attack

A 10-year-old Windows vulnerability is still being exploited in attacks to make it appear that executables are legitimately signed, with the fix from Microsoft still "opt-in" after all these years. Even worse, the fix is removed after upgrading to Windows 11.
www.bleepingcomputer.com www.bleepingcomputer.com
 

My Computer My Computer

At a glance

Home26H2CanAMD Ryzen 5 8600G (07/24)2x32GB Kingston FURY DDR5 5600 MHz CL36 @5200...ASROCK Radeon RX 6600 Challenger D 8G @48FPS ...
OS
Home26H2Can
Computer type
PC/Desktop
CPU
AMD Ryzen 5 8600G (07/24)
Motherboard
ASROCK B650M-HDV/M.2 (07/24) BIOS 4.21 AGESA ComboAM5 1.3.0.1 (04/26)
Memory
2x32GB Kingston FURY DDR5 5600 MHz CL36 @5200 CL36 (07/24)
Graphics Card(s)
ASROCK Radeon RX 6600 Challenger D 8G @48FPS (08/24)
Sound Card
Creative Sound BlasterX AE-5 Plus (05/24)
Monitor(s) Displays
24" Philips 24M1N3200ZS/00 (05/24)
Screen Resolution
1920×1080@165Hz via DP1.4
Hard Drives
Kingston KC3000 NVMe 2TB (05/24)
ADATA XPG GAMMIX S11 Pro 512GB (07/19)
PSU
Seasonic Core GM 550 Gold (04/24)
Case
Fractal Design Define 7 Mini with 3x Noctua NF-P14s/12@555rpm (04/24)
Cooling
Noctua NH-U12S with Noctua NF-P12 (04/24)
Keyboard
HP Pavilion Wired Keyboard 300 (07/24) + Rabalux 76017 Parker (01/24)
Mouse
Logitech M330 Silent Plus (01/26)
Internet Speed
500/100 Mbps via RouterOS (05/21) & TCP Optimizer
Browser
Edge, Brave for YouTube, LibreWolf for FB
Antivirus
NextDNS blocking 1/3 Traffic
Other Info
Phone: Motorola Moto G86 (02/26)
Backup: Hasleo Backup Suite (PreOS)
Headphones: Sennheiser RS170 (09/10)
Chair: Huzaro Force 4.4 Grey Mesh (05/24)
Notifier: Xiaomi Mi Band 9 Milanese (10/24)
FlexCore USB-C 3.2 Gen 1 (M) to LAN (F) (08/25)
You can use option 2 or 4 below to enable LSA again without getting the warning. :alien:

www.elevenforum.com

Enable or Disable Local Security Authority (LSA) Protection in Windows 11

This tutorial will show you how to enable or disable Local Security Authority (LSA) protection for all users in Windows 11. Core isolation is a security feature of Microsoft Windows that protects important core processes of Windows from malicious software by isolating them in memory. It does...
www.elevenforum.com www.elevenforum.com
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro for WorkstationsIntel i7-8700K 5 GHz64 GB (4x16GB) G.SKILL TridentZ RGB DDR4 3600...ASUS ROG-STRIX-GTX1080TI-O11G-GAMING (11GB GD...
    OS
    Windows 11 Pro for Workstations
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom self build
    CPU
    Intel i7-8700K 5 GHz
    Motherboard
    ASUS ROG Maximus XI Formula Z390
    Memory
    64 GB (4x16GB) G.SKILL TridentZ RGB DDR4 3600 MHz (F4-3600C18D-32GTZR)
    Graphics Card(s)
    ASUS ROG-STRIX-GTX1080TI-O11G-GAMING (11GB GDDR5X)
    Sound Card
    Integrated Digital Audio (S/PDIF)
    Monitor(s) Displays
    2 x Samsung Odyssey G75 27"
    Screen Resolution
    2560x1440
    Hard Drives
    1TB Samsung 990 PRO M.2,
    4TB Samsung 990 PRO M.2,
    TerraMaster F8 SSD Plus NAS
    PSU
    Seasonic Prime Titanium 850W
    Case
    Thermaltake Core P3 wall mounted
    Cooling
    Corsair Hydro H115i
    Keyboard
    Amazon Basics Wired Full Keyboard MD005
    Mouse
    Logitech MX Master 4
    Internet Speed
    2 Gbps Download and 100 Mbps Upload
    Browser
    Chrome and Edge
    Antivirus
    Microsoft Defender
    Other Info
    Logitech Z625 speaker system,
    Logitech BRIO 4K Pro webcam,
    HP Color LaserJet Pro MFP M477fdn,
    CyberPower CP1500PFCLCD
    Galaxy S23 Plus phone

  • At a glance

    Windows 11 ProSnapdragon X Elite (12 core) 3.42 GHz16 GB LPDDR5x-7467 MHz
    Operating System
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    Surface Laptop 7 Copilot+ PC
    CPU
    Snapdragon X Elite (12 core) 3.42 GHz
    Memory
    16 GB LPDDR5x-7467 MHz
    Monitor(s) Displays
    15" HDR
    Screen Resolution
    2496 x 1664
    Hard Drives
    1 TB SSD
    Internet Speed
    Wi-Fi 7 and Bluetooth 5.4
    Browser
    Chrome and Edge
    Antivirus
    Microsoft Defender
Good morning
I have the same problem on a new PC (20 days) with AMD Ryzen 5 5600G processor, and Windows 11 22H2 22261.1555.
Tried everything, disabling Credential Guard and LSA but still these messages!
 

My Computer My Computer

At a glance

Windows 11 22H2 22621.1485AMD Ryzen 5 5600G16 Go DDR4 Silicon Power ComputerIntégré AMD Radeon Vega Cezanne
OS
Windows 11 22H2 22621.1485
Computer type
PC/Desktop
Manufacturer/Model
PC-GAME VANT PC vendu par Power C
CPU
AMD Ryzen 5 5600G
Motherboard
GIGABYTE A520M S2H
Memory
16 Go DDR4 Silicon Power Computer
Graphics Card(s)
Intégré AMD Radeon Vega Cezanne
Sound Card
Intégré Realtek ALC1220
Monitor(s) Displays
1 Philips 240SW 1920x1200 et 1 Samsung SMS22A4501680 x 1050
Screen Resolution
1920 x 1200 et 1680 x 1050
Hard Drives
1 SSD CT1000BX500SSD de 1 To
1 DD Seagate ST2000DM008-2FR102 de 2 To
PSU
Alimentation CoolBox FORCE500 certifiée 80Plus Bronze
Keyboard
Packard Bell PR 1101U
Mouse
Tecurs GM001 2,4 Ghz
Internet Speed
ADSL descendant 947 Mb/s Ascendant 614 Mb/s
Browser
Plusieurs : Edge, Cent, Google
Antivirus
Juste celui de Microsoft
Other Info
Pour l'instant à part des avertissements dans l'observateur d'évènement (dont certains résolus) fonctionnement impeccable et très rapide.
SlicEnDicE said:
En anglais s'il vous plaît. Utilisez Google Translate s'il est difficile d'écrire directement en anglais.
Click to expand...
Good morning,

I have the same problem on a new PC (20 days) with AMD Ryzen 5 5600G processor and Windows 11 22H2 22261.1555.
I tried everything, disabling Credential Guard and LSA but still these messages!



This morning I even tried to deactivate fTPM, the same thing does not change anything!
 

My Computer My Computer

At a glance

Windows 11 22H2 22621.1485AMD Ryzen 5 5600G16 Go DDR4 Silicon Power ComputerIntégré AMD Radeon Vega Cezanne
OS
Windows 11 22H2 22621.1485
Computer type
PC/Desktop
Manufacturer/Model
PC-GAME VANT PC vendu par Power C
CPU
AMD Ryzen 5 5600G
Motherboard
GIGABYTE A520M S2H
Memory
16 Go DDR4 Silicon Power Computer
Graphics Card(s)
Intégré AMD Radeon Vega Cezanne
Sound Card
Intégré Realtek ALC1220
Monitor(s) Displays
1 Philips 240SW 1920x1200 et 1 Samsung SMS22A4501680 x 1050
Screen Resolution
1920 x 1200 et 1680 x 1050
Hard Drives
1 SSD CT1000BX500SSD de 1 To
1 DD Seagate ST2000DM008-2FR102 de 2 To
PSU
Alimentation CoolBox FORCE500 certifiée 80Plus Bronze
Keyboard
Packard Bell PR 1101U
Mouse
Tecurs GM001 2,4 Ghz
Internet Speed
ADSL descendant 947 Mb/s Ascendant 614 Mb/s
Browser
Plusieurs : Edge, Cent, Google
Antivirus
Juste celui de Microsoft
Other Info
Pour l'instant à part des avertissements dans l'observateur d'évènement (dont certains résolus) fonctionnement impeccable et très rapide.
Jacques1945 said:
Good morning,

I have the same problem on a new PC (20 days) with AMD Ryzen 5 5600G processor and Windows 11 22H2 22261.1555.
I tried everything, disabling Credential Guard and LSA but still these messages!



This morning I even tried to deactivate fTPM, the same thing does not change anything!
Click to expand...
any progress?
 

My Computer My Computer

At a glance

Win12 beta (or slow Win 11)Ryzen 9 5900XDDR4 64GB(32x2) 1300mhz 20-19-19-43-62-1TNVidea GeForce GTX 1060 6GB
OS
Win12 beta (or slow Win 11)
Computer type
PC/Desktop
Manufacturer/Model
self build
CPU
Ryzen 9 5900X
Motherboard
GIGABYTE B550 version 1
Memory
DDR4 64GB(32x2) 1300mhz 20-19-19-43-62-1T
Graphics Card(s)
NVidea GeForce GTX 1060 6GB
Screen Resolution
(2) of 3840x2160
Hard Drives
(3) 18TB (4) 9TB 2TB m.2
PSU
850W
Internet Speed
1 gig
Browser
chrome
No progress, unfortunately. It doesn't stop the PC from working but amd or microsoft should fix the problem.
And you, did you succeed?
 

My Computer My Computer

At a glance

Windows 11 22H2 22621.1485AMD Ryzen 5 5600G16 Go DDR4 Silicon Power ComputerIntégré AMD Radeon Vega Cezanne
OS
Windows 11 22H2 22621.1485
Computer type
PC/Desktop
Manufacturer/Model
PC-GAME VANT PC vendu par Power C
CPU
AMD Ryzen 5 5600G
Motherboard
GIGABYTE A520M S2H
Memory
16 Go DDR4 Silicon Power Computer
Graphics Card(s)
Intégré AMD Radeon Vega Cezanne
Sound Card
Intégré Realtek ALC1220
Monitor(s) Displays
1 Philips 240SW 1920x1200 et 1 Samsung SMS22A4501680 x 1050
Screen Resolution
1920 x 1200 et 1680 x 1050
Hard Drives
1 SSD CT1000BX500SSD de 1 To
1 DD Seagate ST2000DM008-2FR102 de 2 To
PSU
Alimentation CoolBox FORCE500 certifiée 80Plus Bronze
Keyboard
Packard Bell PR 1101U
Mouse
Tecurs GM001 2,4 Ghz
Internet Speed
ADSL descendant 947 Mb/s Ascendant 614 Mb/s
Browser
Plusieurs : Edge, Cent, Google
Antivirus
Juste celui de Microsoft
Other Info
Pour l'instant à part des avertissements dans l'observateur d'évènement (dont certains résolus) fonctionnement impeccable et très rapide.
You must log in or register to reply here.

Similar threads

"LSA package is not signed as expected" -- Yes, again.
Replies
3
Views
28K
STRESSED
STRESSED
LSA Credential Guard Errors in Event Log
Replies
6
Views
33K
vis
V
LSA Warning logs in Windows 11 Home 22h2
Replies
4
Views
36K
SanderEHV87
SanderEHV87

Latest Support Threads

Latest Tutorials

Back
Top Bottom