Windows 11 keeps track of everything that happens on your computer with a system called logging events. Every event has a special number to help people understand what’s going on. Some people have noticed a lot of warnings in their Event Viewer about something called Event ID 6155 LSA (LsaSrv) warning. This is about the Local Security Authority (LSA) and it’s basically saying something isn’t right with how an LSA package is checked, which could mess with Credential Guard. This article will talk about what this means, why it matters, and what you can do about it.
Also see: Windows 11/10 Computer Blue Screen When Idle
Page Contents
What does the Event ID 6155 LSA (LsaSrv) warning mean?
The Local Security Authority (LSA) is super important in Windows. It checks who you are, keeps security tight, and manages who gets to do what. The LSA process, or LsaSrv, is a big part of this. It works with things like msv1_0 to make sure everyone is who they say they are.
The warning about the LSA package is not signed as expected is a heads-up that something’s off with how packages are checked. This is a big deal for Credential Guard, a tool that keeps your sign-in details safe from hackers. It means something might be putting this protection at risk.
People think a recent Windows 11 update might have brought this bug along. A lot of folks have seen this warning but haven’t noticed anything wrong with their computers. That said, it’s better to be safe and check it out than to ignore it.
Even though it might just be a harmless bug, figuring out what’s causing it and fixing it helps keep your computer safe and running smoothly.
Linked issue: “Please wait for the User Profile Service” Slow or Stuck
How to fix the Event ID 6155 LSA (LsaSrv) warning in Windows 11
Fixing this warning depends a lot on your computer and what you use it for. We’ve got a few ideas based on what’s worked for others.
1. Uninstall recent updates
Windows updates are mostly good because they make your computer better and safer. But sometimes they can cause new problems. If the warning started after an update, going back to the version before that update might fix the problem.
- Click on the Start button and then select Settings.
- In the Settings window, navigate to Windows Update and then click on Update history.
- In the update history window, scroll down to look for and select Uninstall updates. A new window will pop up, displaying all the recently installed updates.
- Look for updates that were installed around the time the warning first appeared. Once identified, select them and click on the Uninstall button.
- After the uninstallation process is complete, restart your computer to apply the changes.
Going back to an older version can get rid of the warning if it was caused by the update. But, remember, this might also take away some important security updates and new features. It’s a trade-off, so think about what’s best for you. And if you do roll back an update, maybe wait a bit before updating again, just in case the problem hasn’t been fixed yet.
Related resource: Disable Network Level Authentication in Windows 11 or 10
2. Turn on Local Security Authority (LSA) Protection
The Local Security Authority (LSA) is key to keeping your sign-ins safe. Turning on LSA Protection means only programs that Windows trusts can talk to the LSA. This makes it harder for bad software to mess with your computer.
Before you change anything in the Registry Editor, it’s super important to create a system restore point because messing up in there can cause big problems.
- Press Win + R on your keyboard, type
regedit, and then press Enter.
- Within the Registry Editor, navigate to the path
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa. - In the Lsa directory, look for the RunAsPPL entry. If it doesn’t exist, right-click on an empty space, select New, and then choose DWORD (32-bit) Value. Name this new DWORD value as RunAsPPL.
- Double-click on the RunAsPPL entry. In the dialog that appears:
- Set its value data to
1to configure the feature with a UEFI variable. - For Windows 11 version 22H2 users wanting to configure the feature without a UEFI variable, set the value data to
2.
- Set its value data to
- After making this change, close the Registry Editor and restart your computer for the changes to be effective.
Turning on this protection helps keep your computer safe from software that shouldn’t be messing with the LSA. If the warning was caused by something weird going on with LSA, this might fix it. But, it could also cause problems with some programs that need to talk to the LSA, so keep an eye out for any new issues.
3. Disable Credential Guard (not recommended)
Credential Guard is like a safe for your login info, but sometimes it can get in the way. Turning it off might stop the warnings, but it’s not the best idea because it makes your computer less secure.
- Press Win + R on your keyboard, type
regedit, and then press Enter. - Navigate to the path
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa. - Look for the LsaCfgFlags DWORD value. If it doesn’t exist, right-click on an empty space, select New, and then choose DWORD (32-bit) Value. Name this new DWORD value as LsaCfgFlags.
- Double-click on LsaCfgFlags, and set its value data to
0.
- After making this change, close the Registry Editor.
- Restart your computer for the changes to take effect.
Turning off Credential Guard might fix the warning, but it’s like leaving your front door unlocked. If you do turn it off, it should only be until there’s a fix for the problem. Keep an eye on updates from Microsoft that might fix the bug so you can turn Credential Guard back on.
Check for newer updates that may have resolved the issue
Microsoft keeps updating Windows to fix bugs and add new stuff. If this warning is because of a known issue, there’s a good chance they’ll fix it in an update soon.
- Open Settings: Click on the Start button and then select Settings.
- Navigate to Windows Update.
- Click on Check for updates. If there are any available updates, Windows will automatically start downloading them.
- Once the updates are downloaded, follow the on-screen instructions to install them.
- After installation, restart your computer to apply the changes.
Keeping your computer updated is a good way to get rid of problems like this warning. If it was caused by a bug, updating might just make it go away.
Wrapping things up
Windows 11 is always getting better, but sometimes new updates can cause unexpected issues like the Event ID 6155 LSA (LsaSrv) warning. The tips above are meant to help you fix it, but remember to think about what each fix means for your computer. A lot of people have just ignored this warning and been fine, but it’s always good to be careful.
If these fixes don’t work for you, there’s a whole community of users and experts online who might have other ideas. Or you can get in touch with Microsoft support for more help.
