Windows 10: Windows 11 EVENT 6155 - LSA package is not signed as expected. This can cause unexpected...

Hello.This error has occurred even on a fresh install of Windows 11, I cannot seem to fix this. The steps I have taken are...On a local computer: Using the Registry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa. Set the value of the registry key to: "RunAsPPL"=dword:00000001 to configure the feature with a UEFI variable. "RunAsPPL"=dword:00000002 to configure the feature without a UEFI variable only on Windows 11, 22H2. Restart the computer. If the registry key RunAsPPL does not exist create it as a New DWORD 32-bit Value and set the Hexadecimal value to 00000002 GPEDIT.M

:)

 

How to fix LSA package is not signed as expected event log entries?

Each time my PC boot I also have 10 event Warnings ID 6155 "LSA package is not signed as expected. This can cause unexpected behavior with Credential Guard" with the paquets: msv1_0, sfapm, schannel, wdigest, cloudap, pku2u, tspkg, msv1_0, kerberos, negoexts.

And I have an event Error ID 28 Kernel Event Tracing "provider {77811378-e885-4ac2-a580-bc86e4f1bc93}. Error: 0xC0000005" that seems related with the warning because it is caused by the running process Lsalso.exe (Credential Guard & VBS Key Isolation"

In Regedit, I have HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa.

I have fixed:

"RunAsPPL"=dword:00000001

Any ideas???

 

How to fix LSA package is not signed as expected event log entries?

The home (non-work) desktop was upgraded yesterday to Windows 11 Pro 22H2 and afterwards on every boot there are several errors about LSA package is not signed as expected. How do I fix these errors? The desktop has Secure boot enabled with virtual based security enabled for memory protection. The CPU is an Intel i7 8700K, which meets Microsoft's requirements for Windows 11.

 

How to fix LSA package is not signed as expected event log entries?

Solved.

Here is the article on whats happening: Configuring Additional LSA Protection | Microsoft Learn

If you are on a work computer under a domain you should probably use the Group Policy as instructed in the article.

On a local computer:

Using the Registry

1. Open the Registry Editor (RegEdit.exe), and navigate to the registry key that is located at: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa.
   
2. Set the value of the registry key to:
   
   1. "RunAsPPL"=dword:00000001 to configure the feature with a UEFI variable.
      
   2. "RunAsPPL"=dword:00000002 to configure the feature without a UEFI variable (only on Windows 11, 22H2).
      
3. Restart the computer.
   

If the registry key RunAsPPL does not exist create it as a New DWORD (32-bit) Value and set the Hexadecimal value to 00000002

The device that was causing the issue for me was a G935 Gaming Headset, which re-prompted to select the device after I created the key and rebooted.