- Have you just opened Event Viewer and it shows a series of messages from the LSA packet stating that they are not signed as expected, and appear signed with event 6155?
- Although it is not a very serious error, these are the steps to follow to get rid of the error
There are certain Windows bugs that can take you by surprise, basically because you have no idea what they indicate. For example, if you run into the error message, here’s what it means that the LSA packet is not signed as expected and how to fix it. There are few steps and probably one of them will allow you to permanently get rid of your problem, so it’s a matter of spending a few minutes.
Apparently, everything happens after upgrading to Windows 11; when trying to open Event Viewer and it shows a series of messages from the LSA packet stating that they are not signed as expected, appearing signed with event 6155. If that is what you are experiencing, this article will help. much interest, of course.
If you find yourself in this situation, this may cause unexpected behavior with Credential Guard.
Fix “LSA packet is not signed as expected”
In such circumstances, there are some tricks that can be potential solutions for the problem described. Remember that this error does not usually have negative effects on system performance or your user experience, so there is no rush to get rid of it. And before trying it as we are going to recommend, try first looking for possible OS updates; installing them and restarting your computer.
Troubleshooting with a Clean Boot
A Clean Boot or Start is one of the best solutions that Windows makes available to its users. It consists of starting the system with the minimum of applications and drivers that are needed to make it work. Some time ago we told you how to make a Clean Boot on PC, so do not hesitate to start with this.
Enable LSA protection
This solution simply requires that you enable LSA protection with one of the tutorials that allow it, regardless of whether it is through the RFegistry Editor or Local Group Policy Editor on your Windows machine.
Feel free to disable Credential Guard to see if that prevents the warning from showing up in Event Viewer.
Perform a System Restore
If what you want is to get out of the problem at once, try a System Restore:
- Press the Win + R keys to invoke the Run dialog
- In the Run dialog box, type rstrui and click Enter to start the Restore Wizard
- On the System Restore screen, click Next, and check the Show more restore points box
- Click on the restore point before you noticed the problem on your PC, and then on Next
- Click Finish and confirm that you want to proceed with System Restore
Uninstall the recent Windows update
Finally, you should not stop trying to uninstall the most recent update of this operating system. Considering that they can sometimes be unstable, it would not be surprising that they cause problems with the LSA packet.
Other frequently asked questions
How do I enable LSA protection?
If you are managing only a few computers, you can enable them locally at their own desks. All you need to do is go to Windows Security, Device Security, Kernel Isolation Details, enabling the switch of the Local Security Authority protection section.
What is LSA in Active Directory?
The components of the local security authority – or LSA – that applications tend to use to authenticate and log users into the local system are often described under the term “LSA authentication”. They also explain how to build and take advantage of the various packages dedicated to security and authentication.
Do you have any other questions about the LSA packet not being signed as expected? Leave us your comments!
