After enabling Credential Guard by GPO, users running localized smart card tools intermittently hit lsass.exe c0000374 (Heap Corruption) crashes. How can I identify the conflicting CSP/KSP driver?

Question

After enabling Credential Guard by GPO, users running localized smart card tools intermittently hit lsass.exe c0000374 (Heap Corruption) crashes. How can I identify the conflicting CSP/KSP driver?

Answer 1

Hello Rakri,

0xc0000374 in lsass.exe after enabling Credential Guard typically indicates a faulty third-party smart card CSP/KSP, minidriver, or credential provider rather than a Credential Guard defect.

Capture an LSASS crash dump and analyze it with:

!analyze -v

lm

!heap -p -a <faulting_address>

Look for non-Microsoft smart card modules loaded into LSASS. Also run:

certutil -csplist

certutil -key -csp

``

to identify the CSPs/KSPs used by the affected application.

In most cases, the root cause is an outdated smart card middleware component that is not fully compatible with Credential Guard and requires a vendor update or replacement.

Harry.