How to fix LSA package is not signed as expected event log entries?

I used the "Using Local Group Policy on Windows 11, 22H2" from the article you provided: Configuring Additional LSA Protection | Microsoft Learn

I set the "Enabled with UEFI Lock" option

Still getting 10 errors as before

As of 11/1 I'm now getting: Event 6147, LSA (LsaSrv) : Credential Guard is configured to run, but is not licensed. Credential Guard was not started.

(The only system changes were Windows Update "Dell, Inc. - Firmware - 0.1.19.0")

Was hoping the Windows Updates applied last night would help...

That's odd, it instantly solved all of mine.

Since it was a USB device, try unplugging all nonessential USB accessories, I would bet it's the fob.

If it reboots with no LSA error without the USB accessories you might need that reg key and a viable driver.

Driver files did change a bit and require WHQL drivers for most devices. My headset, which this registry key fixed the LSA for, did recently update theirs for certification.

Solved.

...

The device that was causing the issue for me was a G935 Gaming Headset, which re-prompted to select the device after I created the key and rebooted.

Sadly, in my case this didn't work. Still throwing 10+ LSA errors despite setting that key, and with only a card reader(fob) that's got signed drivers, at this point I'm looking at throwing my hands up in the air and hoping that MS sometime, in the future, will actually fix this.

It really doesn't cause me any huge problems, since said work machine 2 is already network isolated but still...irritation at it. At least it's not as bad as the softmodem fiasco with Win95. Anyway to those throwing hints, at least for me I give thanks for something to try.

Solved.

Here is the article on whats happening: Configuring Additional LSA Protection | Microsoft Learn

If you are on a work computer under a domain you should probably use the Group Policy as instructed in the article.

On a local computer:

Using the Registry

1. Open the Registry Editor (RegEdit.exe), and navigate to the registry key that is located at: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa.
2. Set the value of the registry key to:
   1. "RunAsPPL"=dword:00000001 to configure the feature with a UEFI variable.
   2. "RunAsPPL"=dword:00000002 to configure the feature without a UEFI variable (only on Windows 11, 22H2).
3. Restart the computer.

If the registry key RunAsPPL does not exist create it as a New DWORD (32-bit) Value and set the Hexadecimal value to 00000002

The device that was causing the issue for me was a G935 Gaming Headset, which re-prompted to select the device after I created the key and rebooted.

So I have seen this issue with 22H2 on only some machines. This can also affect Remote Desktop login. Here is the answer:

First it is a credential guard problem. Then it is a problem because I thought credential guard was only available on Enterprise Edition of Windows 11. We are running Pro. But if I look under Settings and Core Isolation it says credential guard is active. Which is probably the REAL problem. It shouldn't be active on these machines. We are running Pro.

If your problem is Remote Desktop login or this message then the answer is to turn off credential guard (group policy or the registry on that system Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa then LsaCfgFlagsDefault to 0) or if it is already set to 0 just have that user delete the "saved credentials" from the Credential Manager in control panel for Remote Desktop and NOT USE THAT FEATURE. They need to log in every time they connect.

If it is happening on your internal network...wait to see if it is a problem. If the user can log in and connect to resources then leave it alone. At some point maybe microsoft can fix this. So ignore these errors.

If your version of 11 is anything other than Enterprise...you can have this issue.