Troubleshooting Random Freezing on Windows 11 Laptops with LSA(SRV) Errors

Question

As a technician, there's a recurring issue with customer laptops freezing, and the event viewer shows numerous LSA (lsasrv) warnings with random event IDs ranging from 6000 to 6155.

The laptops often arrive in BIOS reset mode, powering on and off several times before booting. After checking various factors such as Windows updates, event logs, and hardware conditions, a pattern emerges: all affected laptops have the latest Windows update and many LSA warnings prior to freezing. Additionally, there are multiple DistributedCOM warnings with event ID 10016.

Despite efforts to reinstall Windows using version 2004, the freezing persists upon connecting to the internet. Initial thoughts were that the internal wireless adapter might be faulty, but using an external receiver and a LAN cable still resulted in freezing shortly after connecting to the internet.

Any insights or solutions to resolve this issue would be greatly appreciated, as there have been seven different laptop brands with the same problem this month.

Answer 1

Hello Shin,

Thank you for posting in Q&A forum.

Event IDs 6000 to 6155 typically indicate issues related to the security and authentication processes on your system. Here are some steps you can take to address these warnings:

1. Ensure that no user credentials have been changed or removed recently. This can sometimes trigger these warnings.
2. You can enable LSA protection via the Registry Editor:

• Press Win + R, type regedit, and press Enter.

• Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa.

• Set the value of the registry key RunAsPPL to dword:00000001 to configure the feature with a UEFI variable, or dword:00000002 without a UEFI variable (only on Windows 11, 22H2).

3. If you are experiencing issues with Credential Guard, you can disable it:

• Open the Group Policy Editor (gpedit.msc).

• Navigate to Computer Configuration > Administrative Templates > System > Device Guard.

• Double-click Turn on Virtualization Based Security and set it to Disabled.

Note: Please back up the registry before you make changes on it.

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.