How to fix LSA package is not signed as expected event log entries?

On my machines, WLAN autoconfig service is already set as Automatic. I also do not have unused ethernet adapters.

I do not have Advanced Sharing on any of the machines.

LSA errors continue on boot.

I was able to fix this issue by creating a new Admin account on my PC, log into that new account, log out of that new account and back into my original Admin account.

I've had this problem occur on several computers now both at home and in the office (4 work PCs) where the user profile gets corrupted after a Windows update (both Windows 10 or 11).

This is clearly a Windows update since it always happens after a Windows update. Why it happens to specific PC that are completely unrelated is beyond me? Microsoft need to address the update process and add some better logging so they can pin point what is causing user profile corruption.

I’ve tried the new admin account ‘solution’ before. Did not work for any of my Pro machines.

In my case not a corrupt profile.

Unrelated to Windows Updates as well, in my case.

Yup, I have noticed them since I did a repair reinstall of Windows.

• <Event xmlns="**http://schemas.microsoft.com/win/2004/08/events/event**">
• <System> <Provider Name="LsaSrv" Guid="{199fe037-2b82-40a9-82ac-e1d46c792b99}" /><EventID>6155</EventID><Version>0</Version><Level>3</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime="2023-03-22T05:19:28.0933652Z" /><EventRecordID>15133</EventRecordID><Correlation ActivityID="{d8b29278-5c7d-0008-4493-b2d87d5cd901}" /><Execution ProcessID="1568" ThreadID="1572" /><Channel>System</Channel><Computer>XXXXXX</Computer><Security UserID="S-1-5-18" /></System>
• <EventData> <Data Name="PackageName">msv1_0</Data></EventData> </Event>

Also in packages sfapm, schannel, wdigest, cloudap, pku2u, tspkg, msv1_0, kereberos, negoexts

If you are seeing LSA errors for packages negoexts, kerberos, msv1_0, tspkg, pku2u, cloudap, wdigest, schannel, sfapm - it looks like you can ignore those, because they are related to password-based SSO, according to this. These specific warnings (they are not errors in the event viewer!) only indicate that something tried loading one of the affected protocols or it was just the general attempt to load the library. According to MS article, this only blocks SSO, not the whole protocols.

It is clear, that for these particular instances it would warrant Microsoft to write a more appropriate warning text, perhaps also indicating what was calling the library or whether it was a general load of the library during boot-up sequence.

I have not found a way to learn what is actually triggering these libraries/protocols, and what can be done to disable them, if that is safe enough for a particular system (because if they are in use, disabling them may affect other apps).