Windows 11 22H2 upgrade breaks "Run whether user is logged on or not" scheduled tasks

I too am very reliant on the task schedular and running Robocopy scripts across network shares. Acting on your post. I looked at Windows Defender Credential Guard. I ran 2 tests from a laptop with Windows 11 22H2 Build 22621.1344. I created and set permissions on a test folder on our server to only be available to domain admins. I put a bunch of files in it. I created a Robocopy script and scheduled it to run whether logged in or not highest privileges with domain admin credentials. I then logged off the laptop and waited till after the task was supposed to execute. Both times it was successful across network shares. I will continue to test. I am hesitant to post the information here because Microsoft might mess things up again, but the info was on the Microsoft Learn site. https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage

Obviously messing with the windows registry is risky and it's a good idea to back it up before doing this. You might want to set up a test environment just in case. Below is what I did for my test environment.

1. Enable or disable Windows Defender Credential Guard:
   1. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa.
   2. Add a new DWORD value named LsaCfgFlags. Set the value of this registry setting to 1 to enable Windows Defender Credential Guard with UEFI lock, set it to 2 to enable Windows Defender Credential Guard without lock, and set it to 0 to disable it.

This does apparently lower the security level. But with scheduled tasks and Robocopy being so important for me, I feel it's worth it. Microsoft should have reached out with a fix or an opt out for 22H2.

Thank you, I may give this a try. I tried a GPO that supposedly disabled both LSA Protection and Credential Guard, and it didn't help -- but I didn't actually verify that it stopped Credential Guard from running (not sure what reg entries the GPO sets). Not really concerned about disabling Credential Guard in my environment.

This may also be relevant... At boot with 22H2, I have multiple event 6155 entries, each of which name a different LSA plugin and say "LSA package is not signed as expected. This can cause unexpected behavior with Credential Guard." Thinking now that whatever is causing that may be related to this scheduled task problem with credentials.

Under local security policy I disabled the Network Access: Do Not allow Storage of passwords and credentials for network authentication and found teh task scheduler jobs accepted domain accounts.

Its raising on all 2019 servers after December/January security patch updates its impacts task scheduler jobs running with domain accounts.

I too am very reliant on the task schedular and running Robocopy scripts across network shares. Acting on your post. I looked at Windows Defender Credential Guard. I ran 2 tests from a laptop with Windows 11 22H2 Build 22621.1344. I created and set permissions on a test folder on our server to only be available to domain admins. I put a bunch of files in it. I created a Robocopy script and scheduled it to run whether logged in or not highest privileges with domain admin credentials. I then logged off the laptop and waited till after the task was supposed to execute. Both times it was successful across network shares. I will continue to test. I am hesitant to post the information here because Microsoft might mess things up again, but the info was on the Microsoft Learn site. https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage

Obviously messing with the windows registry is risky and it's a good idea to back it up before doing this. You might want to set up a test environment just in case. Below is what I did for my test environment.

1. Enable or disable Windows Defender Credential Guard:
   1. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa.
   2. Add a new DWORD value named LsaCfgFlags. Set the value of this registry setting to 1 to enable Windows Defender Credential Guard with UEFI lock, set it to 2 to enable Windows Defender Credential Guard without lock, and set it to 0 to disable it.

This does apparently lower the security level. But with scheduled tasks and Robocopy being so important for me, I feel it's worth it. Microsoft should have reached out with a fix or an opt out for 22H2.

Just updated to 22H2 and now have BROKEN scheduled tasks. I need tasks to run "whether user is logged on or not", AND I need those tasks to have access to network resources (so the "Do not store password" option, while it allows the task to run, does not support the task's requirements).

I suspect this may be related to either LSA Protection or CredentialGuard, which (for most machines) was auto-enabled with 22H2 update. Before I dig into that, has anyone else already tried disabling LSA Protection and/or Credential Guard to see if that solves the issue?

My current workaround: I added explicit "net use \server\share PASSWORD" into the batch files to connect network resources. The scripts then work with the "Run whether user is logged on or not" and "Do not store password" combination. Obviously, hard-coding passwords for network shares in a script is not a good idea. Microsoft has shot us in the foot here -- their attempt at increasing security on 22H2 is forcing me into less security (plain text passwords in batch files) on 22H2!

Still broken. Any update on this? Any1 care to either confirm or deny the issue? Learn to communicate MSFT!