[EN] Blue Screen or LSASS.exe Crash After Windows 11 Update: “STATUS_IMAGE_CHECKSUM_MISMATCH”

After installing a major cumulative update on Windows 11 23H2 or 24H2, some systems may experience serious startup or login issues. The computer may fail with a Blue Screen of Death during boot, restart immediately after the user logs in, or become unstable because the lsass.exe process crashes.

In many cases, Event Viewer shows errors related to LSA, Local Security Authority, Device Guard, Credential Guard, Code Integrity, or LSASS. One of the error codes that may appear during crash dump analysis or system logs is:

STATUS_IMAGE_CHECKSUM_MISMATCH

This error usually indicates that Windows detected an integrity issue with a critical driver, DLL, or system component. It may also be related to corrupted system files, outdated drivers, storage issues, memory problems, or incompatible low-level security software.

Common Symptoms

This issue is typically observed right after a Windows update. It is especially common on systems that have older VPN clients, endpoint security agents, anti-cheat software, DLP tools, EDR/XDR agents, or legacy authentication components installed.

Common symptoms include:

Windows fails with a Blue Screen during startup.
The system restarts immediately after user login.
lsass.exe or LSAIso.exe related errors appear in Event Viewer.
LSA, Device Guard, Credential Guard, or Code Integrity logs are generated.
The system can only boot in Safe Mode.
VPN, EDR, anti-cheat, or endpoint agents trigger crashes after the update.
Crash dumps contain STATUS_IMAGE_CHECKSUM_MISMATCH.

It is important to understand that this error does not always mean Credential Guard is the only cause. However, if LSASS crashes, LSA-related errors, Device Guard logs, and outdated kernel-level drivers are all present, Credential Guard and Virtualization-Based Security become strong suspects.

What Are Credential Guard and LSA Isolation?

Credential Guard is a Windows security feature designed to protect sensitive authentication data. It uses Virtualization-Based Security, also known as VBS, to isolate credentials from the normal operating system environment.

When Credential Guard is enabled, sensitive credential material is protected inside an isolated security environment. The traditional Local Security Authority process communicates with the isolated LSA component, commonly associated with LSAIso.exe.

This architecture helps protect sensitive data such as NTLM hashes, Kerberos tickets, and domain authentication credentials. It makes credential theft significantly more difficult, especially against attacks that attempt to dump LSASS memory.

However, this stronger security model can expose compatibility issues with older software. Applications or drivers that previously interacted with LSASS or authentication components may no longer work correctly when LSA Isolation, Credential Guard, VBS, or HVCI are active.

Root Cause: Incompatible or Unsigned Kernel-Level Drivers

One of the most common root causes is an outdated or incompatible kernel-level driver. The issue is often seen with the following types of software:

Legacy VPN clients
Old virtual network adapters
Anti-cheat software
EDR, XDR, or endpoint security agents
Antivirus drivers
DLP agents
NAC or 802.1X authentication agents
Smart card middleware
Legacy identity or authentication software
Drivers with expired or invalid signatures
Windows 11 23H2/24H2 incompatible kernel drivers

When Credential Guard and LSA Protection are active, LSASS is no longer a freely accessible process. Software that attempts to inject code into LSA, access protected memory, hook authentication routines, or use unsupported low-level methods may be blocked by Windows security mechanisms.

After a Windows update, these security checks may become stricter. If an old driver, DLL, or security component fails integrity validation, Windows may stop the system to protect it from potential compromise.

Why Does It Happen After a Windows Update?

Windows updates do not only install visual changes or general fixes. Major cumulative updates may also modify or strengthen:

Kernel components
LSASS and LSA behavior
Device Guard policies
Credential Guard behavior
VBS configuration
Hypervisor behavior
Driver signature validation
Memory Integrity / HVCI checks
Code Integrity policies

This is why a system that worked normally before the update may suddenly fail after the update. In many cases, the update is not the direct cause. Instead, the update reveals an existing compatibility issue with an outdated driver, VPN client, anti-cheat module, or endpoint security agent.

Temporary Recovery Approach

If the system is stuck in a boot loop or crashes immediately after login, the first goal is to make the system bootable again.

For this reason, Credential Guard, LSA Isolation, VBS, or HVCI may need to be temporarily disabled. This should be treated as a recovery step, not a permanent security configuration.

The correct approach is:

Boot the system into Safe Mode or Windows Recovery Environment.
Temporarily disable Credential Guard and VBS.
Restart the system.
Identify the incompatible driver or software.
Update or remove the problematic component.
Re-enable the required security features after validation.

Step 1: Boot into Safe Mode or WinRE

If Windows cannot boot normally, allow the system to enter Windows Recovery Environment after repeated failed startup attempts.

Then follow this path:

Troubleshoot
Advanced options
Startup Settings
Restart
Safe Mode

After booting into Safe Mode, open Command Prompt or PowerShell as Administrator.

If Safe Mode is not available, use:

Troubleshoot
Advanced options
Command Prompt

This opens a recovery command-line environment.

Step 2: Disable LSA Isolation / Credential Guard

Run the following command:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LsaCfgFlags /t REG_DWORD /d 0 /f

In domain or enterprise-managed systems, policy-based configuration may also exist. For that reason, the following policy registry value can also be set to disabled:

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard" /v LsaCfgFlags /t REG_DWORD /d 0 /f

Setting LsaCfgFlags to 0 disables Credential Guard.

Step 3: Disable Virtualization-Based Security Temporarily

Because Credential Guard depends on Virtualization-Based Security, VBS may also need to be disabled temporarily.

reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f

If Memory Integrity or HVCI is also causing driver compatibility problems, disable it as well:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled /t REG_DWORD /d 0 /f

Step 4: Disable Hypervisor Launch

In some cases, the hypervisor layer may remain active even after VBS is disabled in the registry. As a temporary recovery step, use the following command:

bcdedit /set hypervisorlaunchtype off

Then restart the system:

shutdown /r /t 0

If the system boots successfully after these commands, the problem is likely related to Credential Guard, VBS, HVCI, or an incompatible kernel-level driver interacting with these security features.

Step 5: Investigate the Root Cause After Boot

Once the system boots successfully, the recovery is not complete. Disabling Credential Guard and VBS reduces the security posture of the system. The real goal is to identify and fix the incompatible component.

Check the following software categories:

VPN clients
Endpoint security agents
Antivirus software
EDR/XDR agents
Anti-cheat software
DLP agents
NAC or 802.1X agents
Smart card middleware
Virtual network adapter software
Old Wi-Fi, Bluetooth, chipset, or storage drivers
Legacy authentication tools

Recently installed or recently updated software should be reviewed first.

Useful locations and tools include:

Event Viewer
Reliability Monitor
Device Manager
Programs and Features
Windows Update History
C:\Windows\Minidump

Step 6: Review Event Viewer Logs

The following Event Viewer paths are useful during investigation:

Windows Logs > System
Windows Logs > Application
Applications and Services Logs > Microsoft > Windows > CodeIntegrity
Applications and Services Logs > Microsoft > Windows > DeviceGuard
Applications and Services Logs > Microsoft > Windows > LSA
Applications and Services Logs > Microsoft > Windows > NTLM > Operational

Search for keywords such as:

LSA
LSAIso
Credential Guard
Device Guard
Code Integrity
driver failed
image checksum
not signed
blocked by Credential Guard

If Code Integrity logs mention a specific .sys driver, that driver is a strong candidate for the root cause. Identify which application owns that driver and update or remove it.

Step 7: Check Credential Guard Status

You can check the Credential Guard status by running the following PowerShell command as Administrator:

(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning

You can also run:

msinfo32.exe

Then check the System Summary section for:

Virtualization-based Security
Credential Guard
Device Guard
Hypervisor detected

These values help confirm whether VBS and Credential Guard are currently active.

Step 8: Repair System Files

Because STATUS_IMAGE_CHECKSUM_MISMATCH may also be related to corrupted system files, disk problems, or memory issues, system integrity checks should also be performed.

Run:

sfc /scannow

Then run:

DISM /Online /Cleanup-Image /RestoreHealth

To check disk consistency:

chkdsk C: /f /r

This command may require a restart.

If memory corruption is suspected, run Windows Memory Diagnostic or a hardware-level memory test tool.

Step 9: Update or Remove Problematic Software

After identifying the suspected component, take the following actions:

Update the VPN client to the latest Windows 11 compatible version.
Update endpoint security, EDR, XDR, or antivirus agents.
Remove old anti-cheat software if it is no longer required.
Remove unused virtual network adapters.
Update chipset, storage, network, Wi-Fi, and Bluetooth drivers.
Update BIOS/UEFI firmware if required.
Confirm that all kernel drivers are digitally signed and supported.
Check the vendor’s Windows 11 23H2/24H2 compatibility documentation.
Remove deprecated corporate agents.
Analyze minidump files if the issue persists.

In enterprise environments, this should be tested on a pilot group before applying changes broadly.

Step 10: Re-Enable Credential Guard After Fixing the Issue

Credential Guard and VBS should not remain disabled unless there is a valid business or compatibility requirement. After the problematic driver or software has been updated or removed, re-enable the security features.

Use the following commands:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 1 /f

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LsaCfgFlags /t REG_DWORD /d 2 /f

bcdedit /set hypervisorlaunchtype auto

shutdown /r /t 0

The common LsaCfgFlags values are:

0 = Credential Guard disabled
1 = Enabled with UEFI lock
2 = Enabled without UEFI lock

In enterprise environments, “Enabled without UEFI lock” may be preferred when remote management and future rollback flexibility are required.

Example Recovery Command Set

The following command set can be used as a temporary recovery method from Safe Mode or WinRE:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LsaCfgFlags /t REG_DWORD /d 0 /f

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard" /v LsaCfgFlags /t REG_DWORD /d 0 /f

reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f

reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled /t REG_DWORD /d 0 /f

bcdedit /set hypervisorlaunchtype off

shutdown /r /t 0

These commands should only be used for troubleshooting and recovery. They should not be considered a permanent hardening recommendation.

Offline Registry Method in WinRE

If the system cannot boot and registry changes do not apply correctly from WinRE, you may need to load the offline Windows registry hive manually.

First, identify the correct Windows drive letter. In WinRE, Windows may not always be mounted as C:.

You can check with:

diskpart
list volume
exit

Or:

dir C:\Windows
dir D:\Windows

If Windows is installed on C:\Windows, load the offline SYSTEM hive:

reg load HKLM\OfflineSystem C:\Windows\System32\Config\SYSTEM

Then apply the required changes:

reg add "HKLM\OfflineSystem\ControlSet001\Control\Lsa" /v LsaCfgFlags /t REG_DWORD /d 0 /f

reg add "HKLM\OfflineSystem\ControlSet001\Control\DeviceGuard" /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f

reg add "HKLM\OfflineSystem\ControlSet001\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled /t REG_DWORD /d 0 /f

After completing the changes, unload the hive:

reg unload HKLM\OfflineSystem

Then restart the system.

Important Notes for Enterprise Environments

In corporate environments, this issue should not be treated as a single-device incident only. If one endpoint fails after a Windows update, other devices with the same VPN, EDR, DLP, NAC, or endpoint agent version may also be affected.

Recommended enterprise actions include:

Test Windows updates on a pilot group first.
Validate VPN, EDR, DLP, NAC, and endpoint agents before broad deployment.
Review Credential Guard and VBS policies in Group Policy or Intune.
Check driver signing and Code Integrity events.
Keep BIOS/UEFI firmware updated.
Maintain a rollback plan before major Windows updates.
Use phased update rings.
Confirm vendor support for Windows 11 23H2 and 24H2.
Avoid disabling Credential Guard permanently unless there is a documented exception.

The STATUS_IMAGE_CHECKSUM_MISMATCH error, LSASS crash, or Blue Screen issue after a Windows 11 update is often related to system integrity validation, driver compatibility, or security enforcement changes introduced by newer Windows builds.

Credential Guard, LSA Isolation, VBS, and HVCI provide important protection for authentication secrets and system integrity. However, outdated or incompatible kernel-level software can conflict with these security mechanisms.

Temporarily disabling Credential Guard and VBS may allow the system to boot, but this should only be used as a recovery step. The permanent solution is to identify the problematic VPN client, endpoint security agent, anti-cheat software, DLP tool, or legacy driver, then update or remove it.

In summary, this issue should not be viewed only as a Windows update failure. In many cases, the update exposes an existing compatibility problem between modern Windows security features and outdated low-level software. A proper solution requires both recovery actions and root cause analysis.