From what I understand Credential Guard is separate, but the logic behind it is somewhat similar to Core Isolation, because both use virtualization.
How to fix LSA package is not signed as expected event log entries?
The home (non-work) desktop was upgraded yesterday to Windows 11 Pro 22H2 and afterwards on every boot there are several errors about LSA package is not signed as expected. How do I fix these errors? The desktop has Secure boot enabled with virtual based security enabled for memory protection. The CPU is an Intel i7 8700K, which meets Microsoft's requirements for Windows 11.
Windows for home | Windows 11 | Security and privacy
Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.
85 answers
Sort by: Most helpful
-
Anonymous
2023-05-07T17:04:52+00:00 -
Anonymous
2023-05-07T16:23:21+00:00 Thanks for the pointers around credential guard, which seems to be enabled on my Win 11 Pro PC build.
I also have Core Isolation enabled, especially after seeing a recent YouTube video that showed for gaming purposes (one of my primary uses of this particular PC), it does not impact gaming performance, in some games it improved the performance, but all within acceptable test variance amounts.Does Core Isolation also enable Credential Guard? They are on the same settings page in Windows Security settings, so I am guessing these LSA errors (negoexts, kerberos and msv1_0 in my event viewer error logs) began showing up after I enabled Core Isolation?
Good to know I can safely ignore these, and Windows is working as intended - Microsoft could do a much better job of their error code descriptions to save the millions of support pages and cumulative millions of hours of their customer's time trying to troubleshoot things that are not security concerns, and just normal Windows operations.
Customer centric or not Microsoft? -
Anonymous
2023-05-05T09:22:22+00:00 I honestly don't know. If you have any LSA errors for modules besides the ones mentioned - it can be. If not - most likely this is something else entirely. Can easily be a driver issue even.
-
Anonymous
2023-05-05T08:59:51+00:00 If you are seeing LSA errors for packages negoexts, kerberos, msv1_0, tspkg, pku2u, cloudap, wdigest, schannel, sfapm - it looks like you can ignore those, because they are related to password-based SSO, according to this. These specific warnings (they are not errors in the event viewer!) only indicate that something tried loading one of the affected protocols or it was just the general attempt to load the library. According to MS article, this only blocks SSO, not the whole protocols.
It is clear, that for these particular instances it would warrant Microsoft to write a more appropriate warning text, perhaps also indicating what was calling the library or whether it was a general load of the library during boot-up sequence.
I have not found a way to learn what is actually triggering these libraries/protocols, and what can be done to disable them, if that is safe enough for a particular system (because if they are in use, disabling them may affect other apps).
Every time I turn on my laptop, I would press the power button and lift my finger after a couple of seconds to let it "cache" my credential. This way, I don't have to hold my finger again on the sign-in screen. It would sign me in automatically with the data in the "cache". Is this LSA error related to my issue? If not, do you know what should I look for? I believe I got this problem after updating to 22H2.
-
Anonymous
2023-04-01T02:36:09+00:00 That error is because Credential Guard is licensed only for Enterprise and Education version of Windows 11. Change your KEY to an Enterprise version of Windows
I’ve never owned either of those versions in Windows 10 or 11 or in fact any Windows version.
I’m on Win 11 Pro.
Microsoft said the issue would occur if a Win 11 version had been downgraded from Enterprise to Pro.
Not in my case and I get the error.
Why would I change my key to Enterprise !