WINDOWS 11 22H2 EVENT VIEWER ERRORS (LSA 6155, 360 WIN HELLO, 15 WININIT, 1108 Windows-Security-Auditing)

Question

All updates up to and including 22621.525 generate the errors in title
I don’t have this issue with 22H1.

These errors with 22H2 on my system worry me because I have no idea of what problems can arise.

Since the beginning of the release of 22H2, all versions (in my case) have generated multiple event messages which I have no idea how to fix
(Event ID 360: Windows hello for business)
(Event ID 6155: LSA package is not signed as expected. This can cause unexpected behaviour with Credential Guard.),
(Event ID 15: Wininit Windows Defender Credential Guard (LsaIso.exe) is configured but the secure kernel is not running; continuing without Windows Defender Credential Guard. )
(Event ID 1108: Microsoft-Windows-Security-Auditing).

I think that all of this is related to a prior install of Windows Enterprise and business credential guard and/or a professional account activation (now disabled) but I’m not certain. When I had the Enterprise version of Win 11, I tried to disable credential guard, LSA service, Windows hello for business and so on to no avail.

I don’t know how to remove all traces of previous accounts.

In BIOS, I also tried to disable secure boot, deleted secure boot keys, reinstalled a clean version of Windows (PRO not Enterprise). I also tried to disable TPM but latest bios version prevents you from disabling PTT setting.

I don’t want to use anything that is related to Windows hello business and I don’t know if these errors are generating problems with the system.

I don’t see any option to disable to whole credential guard package and it doesn’t even seem to be enabled on my Win Pro version.
I don’t work on a network nor do I use RDP for work.

Windows hello for business and credential guard are very confusing and complicated to me and I can’t imagine how bad it must be to understand for someone that has no experience with Windows. Imagine trying to understand UEFI firmware security lock and so on when you don't use it.

This is the most confusing upgrade of Windows for me since Windows XP. I have tested many versions but this is a major challenge!

This is a real pain!!

Did anyone see this problem or better yet find a solution?? or can someone explain what’s going on?

Thanks

Answer 1

Hi, As I feared, no replies :(

I just wanted to add that I'm almost sure that this issue is related to UEFI firmware storing info from Windows install and not clearing it.

I just updated my laptop and lo and behold, same errors as the desktop. I have been using the same MS account for more than 20 years on all the computers that have I have. Even if I install Windows with a local account or use another MS account It seems that something in the firmware of the machine seems to get confused with the fact that this machine (or others I had) doesn't have the settings or the config that might have been programmed or associated with an enterprise version from a volume license of Windows that I used many times on each computer.

Is this the source of the problem? I have no idea but this is very frustrating.

This also seems to be a localized issue because the number of users with the problem is not high.

If someone could at least tell me if I'm on the right track or just shooting in the dark would be appreciated.

Thanks

Answer 2

Hi again,

Just installed latest Dev build 25211.1001 using a local account and no internet.

I have the same issues except
(Event ID 1108: Microsoft-Windows-Security-Auditing)
(Event ID 15: Wininit Windows Defender Credential Guard (LsaIso.exe)

don't show anymore.

246675-event-viewer-dev-build-252111001-2022-10-01.png

I imagine someone is on the ball but there isn't any clear information about the issue and a more user friendly explanation of what Credential Guard, UEFI lock, Hello for business are for and who needs to use it for certain enivrements.

Thanks!

Answer 3

Hi,

Thank you for posting your query.

Kindly check this link for Windows 11, version 22H2 known issues and notifications https://learn.microsoft.com/en-us/windows/release-health/status-windows-11-22h2

--------------------------------------------------------------------------------------------------------------------------------

If the answer is helpful kindly click "Accept as Answer" and upvote it. Thanks.

Answer 4

Same Event Viewer errors

LSA package is not signed as expected. This can cause unexpected behaviour with Credential Guard.

Various 'solutions' have failed.

Win 11 Pro 22H2