28,655 questions
June's D cumulative patch release for 22H2 fixes this issue. Check the preview KB5027303.
"Use FIPS compliant algorithms" + Windows 11 22h2 = ... slow computers?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(166.4, 15%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EU%3C/text%3E%3C/svg%3E)
UJ243
20
Reputation points
Between Windows 11 21H2 and Windows 11 22H2 I've narrowed down a performance issue to having "Use FIPS compliant algorithms" enabled vs disabled (Reg Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy\Enabled)
With this setting enabled, system performance is dramatically slower, high CPU usage of just about every process running, loud CPU fans, etc.
With this setting disabled, the systems run as smoothly and quietly as one might expect.
I'm looking for clues as to other settings or changes with 22H2 that may be in conflict with the FIPS complaint algorithms policy that we may need to investigate to resolve this problem.
Any ideas?
Windows for business Windows Client for IT Pros User experience Other
{count} vote
-
Cody White 5 Reputation points2023-05-31T13:50:02.0766667+00:00 Were you able to locate any solution to this issues or any official response from MS about this. We hare witnessing the same behavior.
Thank!
-
UJ243 20 Reputation points
2023-05-31T13:55:21.3833333+00:00 There is a new registry entry that fixes the problem.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy\Enabled (set to 0)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy\STE (set to 1 to enable FIPS)
I believe Microsoft is still working on documenting it.
-
Cody White 5 Reputation points
2023-05-31T14:05:11.9066667+00:00 I assume if we are using Intune it would be set using OMA-URI at this time or a custom command to set that.
-
UJ243 20 Reputation points
2023-05-31T14:14:56.4566667+00:00 Not sure.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(262.40000000000003, 70%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBB%3C/text%3E%3C/svg%3E)
Bryan Berns 5 Reputation points2023-06-06T22:59:54.2766667+00:00 I just wanted to clarify the answer from @UJ243 . You need to set Enabled = 1 and STE = 1. Setting Enabled = 0 will disable FIPS. You can test this by running POWERSHELL -Command "Get-FileHash C:\Windows\notepad.exe -Algorithm MD5". If it throws an error, FIPS is enabled. I've reached out to my Microsoft contacts to see what they registry value actually does.
-
UJ243 20 Reputation points
2023-06-07T13:28:02.53+00:00 @Bryan Berns @Bryan Berns Let us know, we were told the new STE=1 enables fips through a different method. Leaving both Enabled = 1 and STE=1 does not appear to fix the performance issue for us.
-
UJ243 20 Reputation points
2023-06-07T13:32:05.8933333+00:00 It was our experience that with STE=1 and Enabled=1 the horrific performance issues remained. The full intent of STE=1 is undocumented as far as I'm aware, but we were told it was a new way forward. Maybe someday we'll find out.
Sign in to comment
4 answers
Sort by: Most helpful
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(281.6, 27%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERM%3C/text%3E%3C/svg%3E)
Rob Moore 5 Reputation points2023-06-28T17:51:29.5033333+00:00 -
Cody White 5 Reputation points
2023-06-28T18:32:07.73+00:00 I have reviewed this post which was commented above .More information on details on the fix and the requirement of STE would be nice if Microsoft would provide them.
-
Rob Moore 5 Reputation points
2023-06-28T18:38:53.2166667+00:00 With the new KB, you do not need to change the STE setting in my experience. This was in direct responce to a ticket I had opened with Microsot where they had a bug tracker open for the FIPS issue. This KB is the "fix". It should wrap into next month's Patch Tuesday roll-out. The KB I reference is the preview.
Sign in to comment -
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(67.2, 68%, 16%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELT%3C/text%3E%3C/svg%3E)
Limitless Technology 44,751 Reputation points2023-02-23T16:42:13.5466667+00:00 Hi. Thank you for your question and reaching out. I’d be more than happy to help you with your query
It is likely that the Windows 11 22H2 update changed system settings, which are incompatible with the usage of FIPS compliant algorithms. To look into this further, check the system parameters between the two versions to determine if there are any changes that might be causing the performance issue. You should also check the Windows Event logs for any problems or warnings that may be connected to this problem. Lastly, the Microsoft Help and Recovery Assistant can assist you in identifying and troubleshooting any potential issues.
If the reply was helpful, please don’t forget to upvote or accept as answer, thank you.
-
Limitless Technology 44,751 Reputation points
2023-02-23T16:42:41.1633333+00:00 Double post
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(25.6, 54%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESH%3C/text%3E%3C/svg%3E)
Steve Hoyer 0 Reputation points2023-06-21T11:33:53.9466667+00:00 Has anyone been able to find anything else on this registry setting? I have searched high and low and mostly just find this post. I don't know that this will pass an audit as it appears to still allow old algorithm's to be used.
-
Bryan Berns 5 Reputation points
2023-06-21T13:22:25.6833333+00:00 @Steve Hoyer I have an open support ticket with Microsoft. The STE key is related to FIPS use in the LSA subsystem, but apparently the fact its helping is somewhat "accidental". They are pursuing another avenue to address the performance issue - I will see if one of the engineers can respond here; I do not want to speak for them on the proposed path forward.
-
Bryan Berns 5 Reputation points
2023-06-27T23:35:35.55+00:00 @Steve Hoyer Check out https://support.microsoft.com/en-us/topic/june-27-2023-kb5027303-os-build-22621-1928-preview-1ada2c0a-fa85-43f8-91c4-6ee13fdf278b. I believe this wil address your issue (without the need to deploy the STE key).
-
UJ243 20 Reputation points
2023-06-28T12:05:22.4433333+00:00 I don't see any notes about STE or FipsCompliantAlgorithms in there, is it still not documented? 😂
Sign in to comment -