This was my the state of the reg values
was missing...
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v 1 /t REG_SZ /d lsass.exe
was in there
reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v 1 /t REG_SZ /d lsass.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe" /v AuditLevel /t REG_DWORD /d 8
Changed the value to 1
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL /t REG_DWORD /d 1
The LSA switch stays on, but I don't think it went well. I did restart
So I went to the event log and look if I could find anything...
Intel(R) Ethernet Controller I226-V
Network link is disconnected.
Credential Guard is configured to run, but is not licensed. Credential Guard was not started.
LSA package is not signed as expected. This can cause unexpected behaviour with Credential Guard.
PackageName: negoexts
PackageName: kerberos
PackageName: msv1_0
PackageName: tspkg
PackageName: pku2u
PackageName: cloudap
PackageName: wdigest
PackageName: schannel
PackageName: sfapm
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
The description for Event ID 6062 from source Netwtw12 cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event:
\Device\NDMP3
Intel(R) Wi-Fi 6E AX211 160MHz
The message resource is present but the message was not found in the message table
The server {8CFC164F-4BE5-4FDD-94E9-E2AF73ED4A19} did not register with DCOM within the required timeout.
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
Windows.SecurityCenter.SecurityAppBroker
and APPID
Unavailable
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
WLAN Extensibility Module has stopped.
Module Path: C:\WINDOWS\System32\DriverStore\FileRepository\netwtw6e.inf_amd64_0733664dd1b56944\IntelIHVRouter12.dll
Intel(R) Ethernet Controller I226-V
Network link is disconnected.
The server Microsoft.Windows.ShellExperienceHost_10.0.22621.900_neutral_neutral_cw5n1h2txyewy!App did not register with DCOM within the required timeout.
WLAN Extensibility Module has stopped.
Module Path: C:\WINDOWS\System32\DriverStore\FileRepository\netwtw6e.inf_amd64_0733664dd1b56944\IntelIHVRouter12.dll
Name resolution for the name _ldap._tcp.dc._msdcs.home timed out after none of the configured DNS servers responded. Client PID 2372.
Don't know if it is related, but I have to say I did uninstall onedrive and I don't like my personal files are send to server.