Windows 11 EVENT 6155 - LSA package is not signed as expected. This can cause unexpected behavior with Credential Guard.

Anonymous
2022-11-15T13:04:53+00:00

Hello.

This error has occurred even on a fresh install of Windows 11, I cannot seem to fix this. The steps I have taken are...

On a local computer:

Using the Registry

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa.

Set the value of the registry key to:

"RunAsPPL"=dword:00000001 to configure the feature with a UEFI variable.

"RunAsPPL"=dword:00000002 to configure the feature without a UEFI variable (only on Windows 11, 22H2).

Restart the computer.

If the registry key RunAsPPL does not exist create it as a New DWORD (32-bit) Value and set the Hexadecimal value to 00000002

GPEDIT.MSC

In the Group Policy Editor, navigate to the following location: Computer Configuration > Administrative Templates > System > Device Guard

Select Device Guard.

On the right pane, double-click the Turn on Virtualization Based Security policy.

Turn off credential guard windows 10 gpedit

In the new dialogue box, select the Disabled or Not Configured option.

Click OK to save the changes.

Close the Group Policy Editor.

Restart the computer to apply the changes.

Now this is what's strange here, this is on Windows 11 Pro and apparently only the Enterprise edition has Credential Guard so why is this error occurring? Event 6155 is spamming the Event Viewer.

Please help, thanks again.

Windows for home | Windows 11 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

23 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2023-06-15T16:38:00+00:00

    Sadly, I think this might be one of those issues that Microsoft considers as "not an issue". But, not a bad enough issue for me to downgrade to Win10.

    Was this answer helpful?

    0 comments
  2. Anonymous
    2023-06-15T11:56:48+00:00

    Seeing all these answers here from early in the year and realizing in June 2023 the issue is still not fixed... rolling back to Windows 10 also, I didn't buy a new computer just to engage in bug hunting for MS...

    Was this answer helpful?

    0 comments
  3. Anonymous
    2023-04-08T05:17:54+00:00

    did it work?

    Was this answer helpful?

    0 comments
  4. Anonymous
    2023-03-17T21:52:41+00:00

    Very good read, this gives an aswer as to why the event logs are blowing up:

    https://learn.microsoft.com/

    After opting in: How to identify plug-ins and drivers loaded by the lsass.exe

    You can use the event log to identify LSA plug-ins and drivers that failed to load in LSA protection mode. When the LSA protected process is enabled, the system generates event logs that identify all of the plug-ins and drivers that failed to load under LSA.

    You may see these events in Event Viewer: Microsoft-Windows-Codeintegrity/Operational:

    • Event 3033: This event records that a code integrity check determined that a process (usually lsass.exe) attempted to load a driver that did not meet the Microsoft signing level requirements.
    • Event 3063: This event records that a code integrity check determined that a process (usually lsass.exe) attempted to load a driver that did not meet the security requirements for Shared Sections.

    Shared Sections are typically the result of programming techniques that allow instance data to interact with other processes that use the same security context. This can create security vulnerabilities.

    Was this answer helpful?

    0 comments
  5. Anonymous
    2023-03-09T15:17:14+00:00

    The link below is to the new Windows Insider Canary group, so it has not yet been released to the public. I just mention it because of the info regarding the LSA and its operation and thought you might find it interesting.

    Announcing Windows 11 Insider Preview Build 25314 | Windows Insider Blog

    Was this answer helpful?

    0 comments