LSA protection setting gone, but instead staple protection setting appeared

f14tomcat · May 5, 2023

fg2001gf11F said:
Here is an FBH report for Beta 22624.1690:

The Windows Insider Program

Be the first to see what's next for Windows in the Windows Insider Program. Join the community, provide feedback to help make Windows even better.

aka.ms

Thanks, I upvoted.

f14tomcat · May 5, 2023

I stopped the repetitive 27001 updates by hiding the update. For now.

fg2001gf11F · May 5, 2023

f14tomcat said:
I stopped the repetitive 27001 updates by hiding the update. For now.

I used PSWindowsUpdate to hide it.

How to show or hide updates on Windows 11 - Pureinfotech

To show or hide updates on Windows 11, use the troubleshooter tool or PowerShell with the PSWindowsUpdate module. Here's how.

pureinfotech.com

Hide-WindowsUpdate -KBArticleID KB5007651

Then I changed it back and will wait to see how long it will take MS to fix the silly bug.

Besides the annoyance, KB5007651 Version 1.0.2303.27001-0 seems to be harmless. It does not change the active current Version which stays at 1.0.2303.28002-0.

fg2001gf11F · May 9, 2023

f14tomcat said:
I get all that, too. I might try blocking it with WUMT.

Looks like they fixed the repetitive download of KB5007651 Version 1.0.2303.27001.
On May 8, 2023, at 9:30 PM Pacific time the problem stopped, no more downloads for the same KB5007651.

f14tomcat · May 9, 2023

fg2001gf11F said:
Looks like they fixed the repetitive download of KB5007651 Version 1.0.2303.27001.
On May 8, 2023, at 9:30 PM Pacific time the problem stopped, no more downloads for the same KB5007651.

Thanks, I'll unblock it now and check.

Edit: All ok now. It was gone from my hidden list. MS made it go poof!

tinmar49 · May 9, 2023

I have a warning about the LSA being turned off, but there is no toggle switch to turn it on, only a "dismiss" which I have not touched. This is only in my system 2 which is also in the beta channel.

fg2001gf11F · May 9, 2023

tinmar49 said:
I have a warning about the LSA being turned off, but there is no toggle switch to turn it on, only a "dismiss" which I have not touched. This is only in my system 2 which is also in the beta channel.

The toggle switch has been hidden by a MS experimental feature being disabled.

The toggle switch is useless anyway, the LSA is controlled by the 2 registry entries showing below, RunAsPPL and RunAsPPLBoot set to a value of 2.

By resetting that feature ID or enabling it you can get the toggle switch back:

f14tomcat · May 9, 2023

tinmar49 said:
I have a warning about the LSA being turned off, but there is no toggle switch to turn it on, only a "dismiss" which I have not touched. This is only in my system 2 which is also in the beta channel.

fg is correct, the toggle switch for the feature is just to show it in the Defender UI, but you can toggle it if you wish to see LSA showing there. Use Vive Tool GUI and the manual change function (easier). Set the feature 40025975 to "enabled/active" and reboot. Link to an article and the Vive Tool Gui link is in there.

What Is ViVeTool? How to Use It to Enable Unreleased Features on Windows

ViVeTool is a fantastic way to add more features to Windows with very little effort.

www.makeuseof.com

JohnnyGui · May 10, 2023

I installed the latest anti-malwareplatform KB5007651 which should resolve the LSA yellow bang but I'm still having this issue.

I'm aware that I can dismiss the warning but did this update actually resolve this issue for anyone?

fg2001gf11F · May 10, 2023

JohnnyGui said:
I installed the latest anti-malwareplatform KB5007651 which should resolve the LSA yellow bang but I'm still having this issue.

I'm aware that I can dismiss the warning but did this update actually resolve this issue for anyone?

First of all, the KB5007651 description is incorrect and confusing, it has nothing to do with antimalware, it is an update of the Windows Security platform, Security Application and the Security Service Version.
The update of the antimalware is a separate KB#

as you can see below in the System Information it is version 4.18.23050.2 and it has nothing to do with KB5007651 which is Version 1.0.2303.28002-0.

Anyway, to fix the problem with LSA you need to check the registry entries, as reported previously, and showing again here in the last screenshot. DWORDs RunAsPPL and RunAsPPLBoot are set with the value of 2.
You may have one or both missing or set incorrectly in your machine.
Set them as shown in the screenshot and reboot.

tinmar49 · May 11, 2023

Today, I was told by an IT guy that Microsoft had really F---U- this time and it would cost buisinesses millions to put right. When I posted yesterday, the toggle switch was missing as reported in this thread and others, but today the whole page of Windows privacy and security and also including Defender are totally unresponsive in this pc, the second one listed in "my computer". The pc is totally up to date and in the beta channel.
The KB4052623 update 4.18.23050.2 is not in any of my updates, as mentioned in post # 30.

fg2001gf11F · May 11, 2023

tinmar49 said:
Today, I was told by an IT guy that Microsoft had really F---U- this time and it would cost buisinesses millions to put right. When I posted yesterday, the toggle switch was missing as reported in this thread and others, but today the whole of Windows security including Defender are totally missing from this pc, the second one listed in "my computer". The pc is totally up to date and in the beta channel.
The KB4052623 update 4.18.23050.2 is not in any of my updates, as mentioned in post # 30.

Run this Power Shell command to see what security app is currently installed on your machine:

Get-AppPackage Microsoft.SecHealthUI

fg2001gf11F · May 11, 2023

tinmar49 said:
Today, I was told by an IT guy that Microsoft had really F---U- this time and it would cost buisinesses millions to put right. When I posted yesterday, the toggle switch was missing as reported in this thread and others, but today the whole page of Windows privacy and security and also including Defender are totally unresponsive in this pc, the second one listed in "my computer". The pc is totally up to date and in the beta channel.
The KB4052623 update 4.18.23050.2 is not in any of my updates, as mentioned in post # 30.

This is my Beta, everything looks normal:

.

tinmar49 · May 11, 2023

FG, I have just checked the security as you advised and the number is identical to yours, 1000.25305.9000.0 x64 8wekyb3d8bbwe

fg2001gf11F · May 11, 2023

tinmar49 said:
FG, I have just checked the security as you advised and the number is identical to yours, 1000.25305.9000.0 x64 8wekyb3d8bbwe

Did you try a reset with this Power Shell command?

Get-AppxPackage Microsoft.SecHealthUI -AllUsers | Reset-AppxPackage

Also check the folder c:\Windows\System32\SecurityHealth to see if you have all the required files.
The latest version update is 1.0.2303.28002-0

tinmar49 · May 12, 2023

I tried the first power shell reset command,(post # 35) and nothing seemed to happen.
Then I tried the C:Windows\System32\SecurityHealth and got a lot of red text telling me that the command was not recognised or invalid.

fg2001gf11F · May 12, 2023

tinmar49 said:
I tried the first power shell reset command,(post # 35) and nothing seemed to happen.
Then I tried the C:Windows\System32\SecurityHealth and got a lot of red text telling me that the command was not recognised or invalid.

What command was not recognized?
You just have to look in the folder C:\Windows\System32\SecurityHealth using file explorer and see what is in there.