Build 22621.1265 Received Security update KB5007651 1.0.2302.21002 which caused a problem with current public windows Build 22H2.

Question

This update was received on 2/23/2023 and caused several warnings that seem to be caused by incompatibility with current public Windows Build 22621.1265.

There was absolutely no problem before receiving this update, which seems to be for Dev Build 25305 and not for current public Build 22H2.

https://aka.ms/AAjsnwo

Answer 1

i navigated to the same location you showed above and i have another problem the RunAsPPL isnt even there at all

Other users had the same issue, if the entries are missing you just need to add 2 DWORDs RunAsPPL and RunAsPPLBoot both with the value of 2.

Answer 2

i navigated to the same location you showed above and i have another problem the RunAsPPL isnt even there at all

Answer 3

Manually turning this on from my personal computer only sets the RunAsPPL key to 2. So, either they forgot to generate the RunAsPPLBoot key when enabling LSA Protection or whatever checks Defenders health was programed to check for the presence of both keys. What's sad is that this issue was known for months in Dev and Canary builds. Microsoft needs to do a better job of listening to the community and update their documentation if they are going to make changes.

Nothing mentioned in the MS site about RunAsPPLBoot, that document is pretty old and not updated either. 🤷‍♂️🤐

MS never answered my questions about these security updates either. They just started rolling them out to all users without any clarification😝🤣🤬

Configuring Additional LSA Protection | Microsoft Learn

One web site added this note at the bottom of the article:

Update 1: Microsoft has started rolling out a fix, but it’s taking longer than usual to reflect on all systems worldwide as users continue to run into the problem.

Windows 11 incorrectly warns Local Security Authority protection is off (windowslatest.com)

Answer 4

Manually turning this on from my personal computer only sets the RunAsPPL key to 2. So, either they forgot to generate the RunAsPPLBoot key when enabling LSA Protection or whatever checks Defenders health was programed to check for the presence of both keys. What's sad is that this issue was known for months in Dev and Canary builds. Microsoft needs to do a better job of listening to the community and update their documentation if they are going to make changes.