How to fix LSA package is not signed as expected event log entries?

Anonymous
2022-09-21T15:03:13+00:00

The home (non-work) desktop was upgraded yesterday to Windows 11 Pro 22H2 and afterwards on every boot there are several errors about LSA package is not signed as expected. How do I fix these errors? The desktop has Secure boot enabled with virtual based security enabled for memory protection. The CPU is an Intel i7 8700K, which meets Microsoft's requirements for Windows 11.

Windows for home | Windows 11 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments

85 answers

Sort by: Newest
  1. Anonymous
    2023-05-17T11:15:50+00:00

    My apologies, the LSA errors in question are to do with Credential Guard (read the errors they state that)

    I actually meant Credential Guard is part of Enterprise and Education Editions.

    However, it doesn't change the fact that those errors have been there since 22H2 was released and are shown on fresh installs as well. This is because all the editions share the same unified base image.

    So, you either

    A) wait for Mickeysoft to fix the errors/warnings though current track record with this is probably RIGHT before Windows 12 releases! However, SHOULD they even BE a warning? They should just be "normal logs" saying it is warning is warning you that something isn't right, and having an edition that DOESN'T support it doesn't warrant a warning now does it?. Heck look at the issues with LSA being enabled and it is turning itself off and that has been fixed twice just recently and it is STILL broken.

    or

    B) suppress the event, because Event Viewer hasn't changed in like 30 years and to filter out unwanted "errors" is cumbersome, and you have to do EVERY TIME you load Event Viewer. Can't have it save its last state now can we in 2023? :-)

    or

    C) ignore it and stop posting how do I fix it (Because see A)

    Was this answer helpful?

    3 people found this answer helpful.
    0 comments No comments
  2. Anonymous
    2023-05-17T04:25:16+00:00

    Where did you get this info, that LSA is only for Enterprise and Education builds? I have 2 laptops, 1 has Pro, the other Home, both have LSA warnings (these are not errors).

    I also agree with @Kiwidude: disabling logging for the event is not a good idea, because it does not solve anything. Besides, what if you hide the event and then an actual issue occurs that can be identify by the log entry that you've silenced? Will you suggest Windows reinstall then?

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments No comments
  3. Anonymous
    2023-05-17T01:04:05+00:00

    I am and have only ever been on Pro and these errors occur.

    Your 'solution' didn't work (have tried it before).

    Hiding events does not 'fix' the issue.

    Most of us do indeed just ignore them but that is hardly the point.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments No comments
  4. Anonymous
    2023-05-17T00:57:00+00:00

    Because LSA is only used on Enterprise and Education editions, I find the following will stop the Events as these just can be ignored anyway.

    Open Regedit

    Navigate to key
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System{199fe037-2b82-40a9-82ac-e1d46c792b99}

    And Set Enabled to 0

    Clear all events and reboot. No more LSA events on your Windows 11 (non education/enterprise editions)

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments No comments
  5. Anonymous
    2023-05-10T06:52:52+00:00

    Hm... That's an interesting question. Since you are experiencing this on boot, and RunAsPPLBoot is a setting, that enables LSA during boot, it theoretically can be interfering. I doubt it's the case, unless the scanner device uses some weird (or possibly just outdated) protocol or whatever, but this is a possibility. You can try setting just RunAsPPLBoot or both of the settings to 0 and see if that changes anything. You won't risk anything by doing that, if you revert the settings back afterwards. If your assumption is proven correct, I would consider contacting Microsoft's support to report this as a potential bug.

    Was this answer helpful?

    0 comments No comments