How to fix LSA package is not signed as expected event log entries?

Each time my PC boot I also have 10 event Warnings ID 6155 "LSA package is not signed as expected. This can cause unexpected behavior with Credential Guard" with the paquets: msv1_0, sfapm, schannel, wdigest, cloudap, pku2u, tspkg, msv1_0, kerberos, negoexts.

And I have an event Error ID 28 Kernel Event Tracing "provider {77811378-e885-4ac2-a580-bc86e4f1bc93}. Error: 0xC0000005" that seems related with the warning because it is caused by the running process Lsalso.exe (Credential Guard & VBS Key Isolation"

In Regedit, I have HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa.

I have fixed:

"RunAsPPL"=dword:00000001

Any ideas???

If you base the "only Enterprise and Education" statement on https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage page - it also mentions Pro version on the same page, so I would not be so sure of the scope of builds, where this feature applies. It is possible MS are not so sure themselves.

I agree that ideally this needs to be addressed by MS. In fact, I created an item in Feedback Hub for what could be a start of a fix long ago: https://aka.ms/AAk96g4 . Whether it will be addressed (ever) and how it will be addressed - are separate matters. Personally, I do not think these warnings should stop being warnings: "warning" by definition does not mean that something is wrong, it means, that something may be wrong, and if you look at these messages with a broader view - that's exactly what they are telling. Problem is, that the exact warning messages discussed in this very specific forum thread are triggered not by the block of the whole packages, but by the block of protocols in those modules, that are no longer supported. I believe, that such protocol blocks should be a separate event type, and that may be "info" instead of "warning", indeed, as long as it also have separate event ID.

Suppressing these warnings would make sense, if they had clear context, which they currently do not, so theoretically you can get a corrupted module, that will be reported in the same manner. "There will be other events that will tie into it" is an assumption, and unless we get a real-life case for this, we can't be certain if they will be, indeed, other relevant events. Although, I do agree, that most likely there will be other symptoms.

I am not against supression of this warning, though. I just would not want to recommend it to people who are not savvy-enough in the matter. When you recommend something like this you need to be clear of potential risks, no matter how small they seem to you, because for other people they may not be as small. If a "layman" user suppresses these warnings, they will most likely completely forget about it, and when they had another problem and they come to some tech-person, that tech-person may completely misdiagnose the issue and, at least, waste time. Coming from tech support, I would not wish this to anyone.

Solved.

Here is the article on whats happening: Configuring Additional LSA Protection | Microsoft Learn

If you are on a work computer under a domain you should probably use the Group Policy as instructed in the article.

On a local computer:

Using the Registry

1. Open the Registry Editor (RegEdit.exe), and navigate to the registry key that is located at: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa.
2. Set the value of the registry key to:
   1. "RunAsPPL"=dword:00000001 to configure the feature with a UEFI variable.
   2. "RunAsPPL"=dword:00000002 to configure the feature without a UEFI variable (only on Windows 11, 22H2).
3. Restart the computer.

If the registry key RunAsPPL does not exist create it as a New DWORD (32-bit) Value and set the Hexadecimal value to 00000002

The device that was causing the issue for me was a G935 Gaming Headset, which re-prompted to select the device after I created the key and rebooted.

I just completed doing windows update 2022-10 Cumulative Update for Windows 11 Version 22H2 for x64-based Systems (KB5019509)
After reboot, these events are still occurring

Thank you for the log file. According to the content, it contains the security protocol package of the system/third-party software. We have not received relevant reports on the frequent LAS errors after the update of 22H2. Given that it may indeed exist, I suggest you refer to the Feedback Hub to submit the issue to the BUG collection department (Feedback can upload logs and screenshots) so that we can investigate the issue.