How to fix LSA package is not signed as expected event log entries?

Anonymous
2022-09-21T15:03:13+00:00

The home (non-work) desktop was upgraded yesterday to Windows 11 Pro 22H2 and afterwards on every boot there are several errors about LSA package is not signed as expected. How do I fix these errors? The desktop has Secure boot enabled with virtual based security enabled for memory protection. The CPU is an Intel i7 8700K, which meets Microsoft's requirements for Windows 11.

Windows for home | Windows 11 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments

85 answers

Sort by: Oldest
  1. Anonymous
    2023-05-17T11:34:11+00:00

    "Besides, what if you hide the event and then an actual issue occurs that can be identify by the log entry that you've silenced? Will you suggest Windows reinstall then?"

    There will be other events that will tie into it if there is an ACUTAL Issue.. and besides it not that hard to turn back on either (same as I posted with using a 1 instead of a 0)

    If your computer won't even boot or is unusable and you need to turn that event back on, then I'm sorry you have bigger fish to fry in that case and turning it back on again isn't going to help you so yes, a re-install is probably going to fix it.

    Your comment/scenario is just hyperbole at best.

    Was this answer helpful?

    0 comments No comments
  2. Anonymous
    2023-05-17T11:54:21+00:00

    If you base the "only Enterprise and Education" statement on https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage page - it also mentions Pro version on the same page, so I would not be so sure of the scope of builds, where this feature applies. It is possible MS are not so sure themselves.

    I agree that ideally this needs to be addressed by MS. In fact, I created an item in Feedback Hub for what could be a start of a fix long ago: https://aka.ms/AAk96g4 . Whether it will be addressed (ever) and how it will be addressed - are separate matters. Personally, I do not think these warnings should stop being warnings: "warning" by definition does not mean that something is wrong, it means, that something may be wrong, and if you look at these messages with a broader view - that's exactly what they are telling. Problem is, that the exact warning messages discussed in this very specific forum thread are triggered not by the block of the whole packages, but by the block of protocols in those modules, that are no longer supported. I believe, that such protocol blocks should be a separate event type, and that may be "info" instead of "warning", indeed, as long as it also have separate event ID.

    Suppressing these warnings would make sense, if they had clear context, which they currently do not, so theoretically you can get a corrupted module, that will be reported in the same manner. "There will be other events that will tie into it" is an assumption, and unless we get a real-life case for this, we can't be certain if they will be, indeed, other relevant events. Although, I do agree, that most likely there will be other symptoms.

    I am not against supression of this warning, though. I just would not want to recommend it to people who are not savvy-enough in the matter. When you recommend something like this you need to be clear of potential risks, no matter how small they seem to you, because for other people they may not be as small. If a "layman" user suppresses these warnings, they will most likely completely forget about it, and when they had another problem and they come to some tech-person, that tech-person may completely misdiagnose the issue and, at least, waste time. Coming from tech support, I would not wish this to anyone.

    Was this answer helpful?

    4 people found this answer helpful.
    0 comments No comments
  3. Anonymous
    2023-05-22T08:08:44+00:00

    I have 3 computers at home, one for 5800x3D, 2 miniboxes for 5095, connected like set-top boxes to TVs. All PCs have a licensed Windows 11 OS with the latest updates. The distribution was downloaded from the official site. There is an LSA error on every device. So I guess it's just not worth paying attention to. It doesn't affect performance in any way.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments No comments
  4. Anonymous
    2023-05-22T10:20:21+00:00

    I have Professional, and I get the warnings.

    I tried your registry change and it did stop the logging it the warnings.

    There shouldn't be innocuous warnings logged, and why they aren't removed is a mystery.

    Was this answer helpful?

    0 comments No comments
  5. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.


    Comments have been turned off. Learn more