Microsoft has pulled a latest Microsoft Defender replace that was supposed to repair a identified subject triggering persistent restart alerts and Home windows Safety warnings that Native Safety Authority (LSA) Safety is off.
LSA Safety helps safeguard Home windows customers from credential theft makes an attempt by thwarting LSASS course of reminiscence dumping and the injection of untrusted code into the LSASS.exe course of, which might in any other case permit the extraction of delicate data.
Microsoft acknowledged the difficulty on March 21, after widespread person experiences relating to Home windows 11 techniques warning that LSA safety was off. Nonetheless, it was being proven within the settings person interface as being toggled on.
Redmond says the persistent restart alerts triggered by this identified subject will solely seem on Home windows 11 21H2 and 22H2 techniques.
A subsequent Microsoft Defender replace issued weeks later changed the LSA Safety function’s person interface setting with a brand new function known as Kernel-mode {Hardware}-enforced Stack Safety. Sadly, Microsoft has not documented this alteration, resulting in person confusion.
“LSA Safety has not been eliminated – it’s nonetheless in-built and on by default on Home windows 11 machines. Within the newest Home windows Insider Preview, there was an replace that modified the looks of the person interface (UI) for this function,” Microsoft informed BleepingComputer, mistakenly saying it was solely in Home windows 11 Insider builds when it was already accessible in Home windows 11 22H2.
One week later, on April 26, Redmond introduced they fastened the LSA Safety UI subject, nevertheless, this was simply accomplished by eradicating the setting within the KB5007651 Defender replace to make sure that the complicated alerts would not be displayed within the Home windows Settings app.
Defender replace inflicting blue screens and random reboots
At present, Redmond revealed that it determined to cease pushing the KB5007651 Defender replace attributable to blue screens or sudden system restarts when gaming affecting Home windows 11 techniques the place the Defender replace was deployed.
“This identified subject was beforehand resolved with an replace for Microsoft Defender Antivirus antimalware platform KB5007651 (Model 1.0.2303.27001) however points had been discovered, and that replace is not being provided to gadgets,” Microsoft stated.
“When you’ve got put in Model 1.0.2303.27001 and obtain an error with a blue display, or in case your gadget restarts when trying to open some video games or apps, you’ll need to disable Kernel-mode {Hardware}-enforced Stack Safety.”
To disable Kernel-mode HSP, you’ll have to go to Gadget Safety > Core Isolation within the Home windows Safety app and toggle the “Kernel-mode {Hardware}-enforced Stack Safety” function.
Nonetheless, Microsoft doesn’tdoesn’t present any data on what affected customers who already put in KB5007651 ought to do to deal with the system restarts and blue screens brought on by this buggy Defender replace apart from to disable the Kernel-mode {Hardware}-enforced Stack Safety function.
Among the conflicting recreation anti-cheat drivers inflicting Home windows crashes or conflicts when Kernel-mode HSP is enabled embrace PUBG, Valorant (Riot Vanguard), Bloodhunt, Future 2, Genshin Impression, Phantasy Star On-line 2 (Recreation Guard), and Dayz.
Workaround accessible till a repair is launched
Microsoft says it’sit’s engaged on one other repair for the relentless LSA Safety warnings affecting Home windows 11 techniques and can present extra particulars as quickly as doable.
Redmond additionally shared a workaround for patrons who have not put in KB5007651 and are nonetheless seeing restart warnings, asking them to disregard the reboot notifications.
“When you’ve got enabled Native Safety Authority (LSA) safety and have restarted your gadget a minimum of as soon as, you’ll be able to dismiss warning notifications and ignore any extra notifications prompting for a restart,” the corporate says.
You possibly can examine if the function is enabled in your pc utilizing the Home windows Occasion Viewer by on the lookout for a Wininit occasion saying that “LSASS.exe was began as a protected course of with stage:4,” indicating that the method is remoted and guarded by LSA Safety.
Whereas BleepingComputer has beforehand reported that these warnings might be prevented by including two registry entries, Microsoft does “not advocate some other workaround for this subject.”
​Two months in the past, Microsoft introduced that LSA Safety can be enabled default for Home windows 11 Insiders within the Canary channel if their techniques handed an incompatibility audit examine.
A complicated mess
Microsoft continues to confusingly talk about Kernel-mode {Hardware}-enforced Stack Safety in troubleshooting steps relating to LSA Safety.
Up to now, Microsoft particularly informed BleepingComputer that the 2 options are unrelated, but they proceed to conflate the 2 options in help bulletins.
“LSA and Kernel-mode hardware-enforced stack safety are separate settings. Within the newest Home windows Insider Preview construct, the kernel-mode HSP setting was added. It’s not a substitute for LSA safety,” Microsoft informed BleepingComputer.
Nonetheless, even this data is wrong, as Kernel-mode HSP is in manufacturing builds already and never simply Home windows Insider previews, inflicting much more confusion.
Microsoft has nonetheless not launched any official documentation on Kernel-mode {Hardware}-enforced Stack Safety, though it has been accessible in Home windows 11 for nearly a month.