Windows 10: How to fix LSA package is not signed as expected event log entries?

The home non-work desktop was upgraded yesterday to Windows 11 Pro 22H2 and afterwards on every boot there are several errors about LSA package is not signed as expected. How do I fix these errors? The desktop has Secure boot enabled with virtual based security enabled for memory protection. The CPU is an Intel i7 8700K, which meets Microsoft's requirements for Windows 11.

:)

 

LSA Registry entry creates Event Log error (Windows 10 Home)

Hi Folks

I've been in touch with Mcafee Support to uninstall TrueKey, but it has left a Windows registry entry that they (nor I) can get rid of.

The registry entry is: "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages"

and it contains:

"scecli

"C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter""

Because TrueKey and all its folders have been removed (and all Mcafee registry entries by Support), Windows (at start-up) can't find the DLL and flags the following Administrator Event Alert in my log:

"The password notification DLL "C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter" failed to load with error 126. Please verify that the notification DLL path defined in the registry,
HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages, refers to a correct and absolute path (<drive>:\<path>\<filename>.<ext>) and not a relative or invalid path. If the DLL path is correct, please validate that any supporting
files are located in the same directory, and that the system account has read access to both the DLL path and any supporting files. Contact the provider of the notification DLL for additional support. Further details can be found on the web at
http://go.microsoft.com/fwlink/?LinkId=245898."

My question is:

Can I safely delete the "Notification Packages" registry entry under "HKLM\System\CurrentControlSet\Control\Lsa\"
and do you think this will resolve the problem I have with Administrator Event Log Alerts?

I have no idea how the above registry entry was created (TrueKey or Windows), but I would like to be rid of the logs it creates.

Any help appreciated.

 

Event ID 6033: LSA (LsaSrv)

Hi.
Today two events 6033 appeared in my events log:

"An anonymous session connected from MY_COMPUTER has attempted to open an LSA policy handle on this machine. The attempt was rejected with STATUS_ACCESS_DENIED to prevent leaking security sensitive information to the anonymous caller.
The application that made this attempt needs to be fixed. Please contact the application vendor. As a temporary workaround, this security measure can be disabled by setting the \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contr ol\Lsa\TurnOffAnonymousBlock DWORD value to 1.
This message will be logged at most once a day."

What's going on? I ran both Malwarebyter Anti-Rootkit and Anti-Malware but nothing has been found.

Thank you.

UPDATE: I noticed that, both times, Sandboxie was started (manually). Maybe it's caused by Sandboxie.

 

Security event log entries missing values when generated from network access

Hi,

That is correct, the server is part of a domain and so are the machines and users connecting to it which cause these strange "data-less" event log entries. When other machines on the same domain are configured in the same way, the same event log entries
(4656) contain data as expected. Only 4656 events coming from other machines on the network cause this problem, making changes locally created normal entries.

This is a client machine but I can gather any information that you might need to assist in figuring this out.

As per your suggestion, I have re-posted this on the Microsoft TechNet Support site as well: Security event log entries missing values when generated from network access