MicrosoftYep, absolutely an abnormal result. Didn't post it for diagnosis, just an observation across a range of Windows 11 devices where I've experienced this.
They'd all fail with Credential Guard enabled and no line-of-sight to a DC, with an "RPC call failed" error, LSASS crashing (0xC0000409) and insta-rebooting the system. Systems could be used without line-of-sight to a DC with Credential Guard disabled.
So I finally had some time to spin up a test system with a clean Windows 11 install and it works as expected, so pulled the telemetry from the impacted systems and worked out they were all upgrades from Windows 10. Then proceeded to gather all the Device Guard-related registry keys and perform a diff against the Windows 11 working baseline. All impacted systems had the Lsa\MSV1_0 subkey missing as a commonality. Replaced the missing subkey and values from the clean install of Windows 11, rebooted a couple of impacted systems with Credential Guard enabled and no line-of-sight to a DC and hey presto - cached credentials working again! Interestingly, Lsa\MSV1_0 subkey now holds an IsolatedCredentialsRootSecret value, so I'm wondering if the absence of this value was the root cause for the LSASS crash/insta-reboot.
Anyway, thanks for this blog post and your reply. If it wasn't for that I probably would have spent time on working through other annoying misconfigurations - either mine or Microsoft-induced 🙂
