Windows 11 22H2 upgrade breaks "Run whether user is logged on or not" scheduled tasks

I too am very reliant on the task schedular and running Robocopy scripts across network shares. Acting on your post. I looked at Windows Defender Credential Guard. I ran 2 tests from a laptop with Windows 11 22H2 Build 22621.1344. I created and set permissions on a test folder on our server to only be available to domain admins. I put a bunch of files in it. I created a Robocopy script and scheduled it to run whether logged in or not highest privileges with domain admin credentials. I then logged off the laptop and waited till after the task was supposed to execute. Both times it was successful across network shares. I will continue to test. I am hesitant to post the information here because Microsoft might mess things up again, but the info was on the Microsoft Learn site. https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage

Obviously messing with the windows registry is risky and it's a good idea to back it up before doing this. You might want to set up a test environment just in case. Below is what I did for my test environment.

1. Enable or disable Windows Defender Credential Guard:
   1. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa.
   2. Add a new DWORD value named LsaCfgFlags. Set the value of this registry setting to 1 to enable Windows Defender Credential Guard with UEFI lock, set it to 2 to enable Windows Defender Credential Guard without lock, and set it to 0 to disable it.

This does apparently lower the security level. But with scheduled tasks and Robocopy being so important for me, I feel it's worth it. Microsoft should have reached out with a fix or an opt out for 22H2.

Under local security policy I disabled the Network Access: Do Not allow Storage of passwords and credentials for network authentication and found teh task scheduler jobs accepted domain accounts.

Its raising on all 2019 servers after December/January security patch updates its impacts task scheduler jobs running with domain accounts.

I too am very reliant on the task schedular and running Robocopy scripts across network shares. Acting on your post. I looked at Windows Defender Credential Guard. I ran 2 tests from a laptop with Windows 11 22H2 Build 22621.1344. I created and set permissions on a test folder on our server to only be available to domain admins. I put a bunch of files in it. I created a Robocopy script and scheduled it to run whether logged in or not highest privileges with domain admin credentials. I then logged off the laptop and waited till after the task was supposed to execute. Both times it was successful across network shares. I will continue to test. I am hesitant to post the information here because Microsoft might mess things up again, but the info was on the Microsoft Learn site. https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage

Obviously messing with the windows registry is risky and it's a good idea to back it up before doing this. You might want to set up a test environment just in case. Below is what I did for my test environment.

1. Enable or disable Windows Defender Credential Guard:
   1. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa.
   2. Add a new DWORD value named LsaCfgFlags. Set the value of this registry setting to 1 to enable Windows Defender Credential Guard with UEFI lock, set it to 2 to enable Windows Defender Credential Guard without lock, and set it to 0 to disable it.

This does apparently lower the security level. But with scheduled tasks and Robocopy being so important for me, I feel it's worth it. Microsoft should have reached out with a fix or an opt out for 22H2.

Thank you, I may give this a try. I tried a GPO that supposedly disabled both LSA Protection and Credential Guard, and it didn't help -- but I didn't actually verify that it stopped Credential Guard from running (not sure what reg entries the GPO sets). Not really concerned about disabling Credential Guard in my environment.

This may also be relevant... At boot with 22H2, I have multiple event 6155 entries, each of which name a different LSA plugin and say "LSA package is not signed as expected. This can cause unexpected behavior with Credential Guard." Thinking now that whatever is causing that may be related to this scheduled task problem with credentials.

Update regarding Scheduled task. Disabling Credential Guard allowed the scheduled task to run One time successfully, after that, the task continues to run and will not start over again. I've checked if the running tasks does not stop force it to stop and stop the task if it runs longer than 2 hours. So, my attempt at fixing this issue has failed. My windows 10 21H2 and windows 11 21H2 boxes are working fine for Task Scheduler and my Robocopy Scripts. I've set those not to allow a feature update for 365 days in group policy. Not sure if Microsoft is going to attempt a fix regarding this.

Since my previous post about this issue I've tried additional measures mentioned in this thread; none have worked. I've been racking my brain trying to find what's different, and why this Scheduled Task works on some setups and not others for no discernable reason. Finally noticed something interesting.

Windows Version:

21H2 -> Scheduled Task OK!

22H2 -> Clean OS install -> Scheduled Task OK!

22H2 -> Upgrade from 21H2, user profile is present before upgrading to 22H2 -> TASK FAILED

22H2 -> Upgrade from 21H2, new user profile created after upgrade and new task created -> Scheduled Task OK!

It appears that something in the 21H2 -> 22H2 upgrade process causes existing profiles to have this trouble.

Creating a NEW user profile and Scheduled Task to "run whether the user is logged on or not" works reliably!

This is not a fix for what looks like a bug in the Windows upgrade process, but it does help narrow down the issue.