Windows 10: How to fix LSA package is not signed as expected event log entries?

Discus and support How to fix LSA package is not signed as expected event log entries? in Windows 10 Software and Apps to solve the problem; The home non-work desktop was upgraded yesterday to Windows 11 Pro 22H2 and afterwards on every boot there are several errors about LSA package is not... Discussion in 'Windows 10 Software and Apps' started by A123, Sep 21, 2022.

  1. A123 Win User

    How to fix LSA package is not signed as expected event log entries?


    The home non-work desktop was upgraded yesterday to Windows 11 Pro 22H2 and afterwards on every boot there are several errors about LSA package is not signed as expected. How do I fix these errors? The desktop has Secure boot enabled with virtual based security enabled for memory protection. The CPU is an Intel i7 8700K, which meets Microsoft's requirements for Windows 11.

    :)
     
  2. yydelilah Win User

    LSA Registry entry creates Event Log error (Windows 10 Home)

    Hi Folks

    I've been in touch with Mcafee Support to uninstall TrueKey, but it has left a Windows registry entry that they (nor I) can get rid of.

    The registry entry is: "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages"

    and it contains:

    "scecli

    "C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter""

    Because TrueKey and all its folders have been removed (and all Mcafee registry entries by Support), Windows (at start-up) can't find the DLL and flags the following Administrator Event Alert in my log:

    "The password notification DLL "C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter" failed to load with error 126. Please verify that the notification DLL path defined in the registry,
    HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages, refers to a correct and absolute path (<drive>:\<path>\<filename>.<ext>) and not a relative or invalid path. If the DLL path is correct, please validate that any supporting
    files are located in the same directory, and that the system account has read access to both the DLL path and any supporting files. Contact the provider of the notification DLL for additional support. Further details can be found on the web at
    http://go.microsoft.com/fwlink/?LinkId=245898."

    My question is:

    Can I safely delete the "Notification Packages" registry entry under "HKLM\System\CurrentControlSet\Control\Lsa\"
    and do you think this will resolve the problem I have with Administrator Event Log Alerts?

    I have no idea how the above registry entry was created (TrueKey or Windows), but I would like to be rid of the logs it creates.

    Any help appreciated.
     
    yydelilah, Sep 21, 2022
    #2
  3. JoeMcLutz Win User
    Event ID 6033: LSA (LsaSrv)

    Hi.
    Today two events 6033 appeared in my events log:

    "An anonymous session connected from MY_COMPUTER has attempted to open an LSA policy handle on this machine. The attempt was rejected with STATUS_ACCESS_DENIED to prevent leaking security sensitive information to the anonymous caller.
    The application that made this attempt needs to be fixed. Please contact the application vendor. As a temporary workaround, this security measure can be disabled by setting the \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contr ol\Lsa\TurnOffAnonymousBlock DWORD value to 1.
    This message will be logged at most once a day."

    What's going on? I ran both Malwarebyter Anti-Rootkit and Anti-Malware but nothing has been found.

    Thank you.

    UPDATE: I noticed that, both times, Sandboxie was started (manually). Maybe it's caused by Sandboxie.
     
    JoeMcLutz, Sep 21, 2022
    #3
  4. How to fix LSA package is not signed as expected event log entries?

    Security event log entries missing values when generated from network access

    Hi,

    That is correct, the server is part of a domain and so are the machines and users connecting to it which cause these strange "data-less" event log entries. When other machines on the same domain are configured in the same way, the same event log entries
    (4656) contain data as expected. Only 4656 events coming from other machines on the network cause this problem, making changes locally created normal entries.

    This is a client machine but I can gather any information that you might need to assist in figuring this out.

    As per your suggestion, I have re-posted this on the Microsoft TechNet Support site as well: Security event log entries missing values when generated from network access
     
    Werner van Deventer, Sep 21, 2022
    #4
Thema:

How to fix LSA package is not signed as expected event log entries?

Loading...
  1. How to fix LSA package is not signed as expected event log entries? - Similar Threads - fix LSA package

  2. Computer freeze Windows 11. LSA package not signed as expected

    in Windows 10 Gaming
    Computer freeze Windows 11. LSA package not signed as expected: My computer freezes when gaming. Tried everything I could think off. Reset BIOS, update drives. DDU drivers/clean install drivers. Memory diagnostic. Now I look through the Event Viewer with multiple warnings leading up to an error and a critical. First: IntelR Ethernet...
  3. Computer freeze Windows 11. LSA package not signed as expected

    in Windows 10 Software and Apps
    Computer freeze Windows 11. LSA package not signed as expected: My computer freezes when gaming. Tried everything I could think off. Reset BIOS, update drives. DDU drivers/clean install drivers. Memory diagnostic. Now I look through the Event Viewer with multiple warnings leading up to an error and a critical. First: IntelR Ethernet...
  4. LSA protection off and LSA package is not signed as expected

    in Windows 10 Gaming
    LSA protection off and LSA package is not signed as expected: A week after resetting W11 Home PC, have gotten Windows security / Device security message:“Local Security Authority protection is off. Your device may be vulnerable.”Checked Event Viewer - WIninit Log and there is NO entry stating: “12: LSASS.exe was started as a protected...
  5. LSA protection off and LSA package is not signed as expected

    in Windows 10 Software and Apps
    LSA protection off and LSA package is not signed as expected: A week after resetting W11 Home PC, have gotten Windows security / Device security message:“Local Security Authority protection is off. Your device may be vulnerable.”Checked Event Viewer - WIninit Log and there is NO entry stating: “12: LSASS.exe was started as a protected...
  6. LSA package is not signed as expected. Windows 11 Home Version 22H2

    in Windows 10 Gaming
    LSA package is not signed as expected. Windows 11 Home Version 22H2: Local Security Authority Protection does not exist as an option to toggle.I get this "Warning LSA package is not signed as expected. This can cause unexpected behavior with Credential Guard. Event 6155"I have gotten this event warning since Version 22H2 OS Build 22621.1702...
  7. LSA package is not signed as expected. Windows 11 Home Version 22H2

    in Windows 10 Software and Apps
    LSA package is not signed as expected. Windows 11 Home Version 22H2: Local Security Authority Protection does not exist as an option to toggle.I get this "Warning LSA package is not signed as expected. This can cause unexpected behavior with Credential Guard. Event 6155"I have gotten this event warning since Version 22H2 OS Build 22621.1702...
  8. Windows 11 EVENT 6155 - LSA package is not signed as expected. This can cause unexpected...

    in Windows 10 Gaming
    Windows 11 EVENT 6155 - LSA package is not signed as expected. This can cause unexpected...: Hello.This error has occurred even on a fresh install of Windows 11, I cannot seem to fix this. The steps I have taken are...On a local computer: Using the Registry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa. Set the value of the registry key to:...
  9. Windows 11 EVENT 6155 - LSA package is not signed as expected. This can cause unexpected...

    in Windows 10 Software and Apps
    Windows 11 EVENT 6155 - LSA package is not signed as expected. This can cause unexpected...: Hello.This error has occurred even on a fresh install of Windows 11, I cannot seem to fix this. The steps I have taken are...On a local computer: Using the Registry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa. Set the value of the registry key to:...
  10. How to fix LSA package is not signed as expected event log entries?

    in Windows 10 Gaming
    How to fix LSA package is not signed as expected event log entries?: The home non-work desktop was upgraded yesterday to Windows 11 Pro 22H2 and afterwards on every boot there are several errors about LSA package is not signed as expected. How do I fix these errors? The desktop has Secure boot enabled with virtual based security enabled for...