Sandboxie causing "An anonymous session connected from [MY COMPUTER NAME] has attempted to open an LSA policy handle ..." on Windows 10

I'm having this exact same error but I'm using Win7 64-bit, Sandboxie v5.30.

All drivers and OS updates are current. I'm using Firefox and Waterfox.

Hi Sam.

Thank you for the update, I'm glad I'm not the only one. Never had such issues on Windows 7 myself, did you have them before installing v5.30?

With all that has been going on with Sandboxie in the last few months I prefer not see such errors which could be interpreted as some sort of Malware infection.

Hi Sam.

I believe by Windows May update you mean 1903? I did not install it as I'm aware of issues.

No BSODs on my side, I will check the BIOS for Intel Turbo Boost later on today.

By the way, do you have KIS installed?

Thank you.

Good day Barbara.

This morning I proceed with the following tests:

1. Closed KIS 2019

2. Loaded Firefox in Sandboxie mode

3. Closed Firefox and re-opened it

4. Repeated steps 2 and 3 for 5 times

5. No event logged

6. Rebooted machine

7. I loaded Firefox in Sandboxie mode, with KIS 2019 active

8. Event logged

This pretty much confirms that it is a conflict with KIS 2019.

Can you kindly ask your developers to proceed with the test case on a machine with KIS 2019 installed and active?

Thank you.

Hi sandboxieuser456,

Our currently supported apps are listed here

Please, reach out to the AV support team so that they can review the situation.  Did you get a chance to look at the link provided before? It may help with your scenario. 

You may also try Resource Access Monitor. (although not sure we will see anything there, worth a shot). 
Ensure you are working in an empty Sandbox
Start Res. Acc. Mon
Immediately reproduce the problem then close Res. Acc. Mon
Post the output. 

Regards,

Hi Barbara.

I'm not sure I understand. Do I have to contact Kaspersky? The problem is not with Kaspersky, if I don't use Sandboxie no events are logged in Event Viewer.

I will Resource Access Manager and post the results.

Hi sandboxieuser456,

Per my original response, this is what the devs said:

The devs stated that this is something on the program's end that not liking Sandboxie using Anonymous Logon (as nothing has changed with Sandboxie in that regard, and there is no malware in our code).

Here's an example of a similar situation:
https://support.microsoft.com/en-us/help/839569/you-may-not-be-able-to-connect-to-an-instance-of-sql-server-by-using-a

Regards,

Hi Barbara.

I'm afraid that is not a similar situation.

I am aware that SQL Server, when installed, can either connect with an anonymous account or an account on the machine but my issue has absolutely nothing to do with this, especially since SQL Server is not even installed on my machine.

The closest case I found similar to mine, if we really want Google to fix this issue for us, is this one:

https://www.tenforums.com/general-support/84319-event-id-6033-lsa-lsasrv.html

But since the old forums are down after last month's disaster, I cannot find the thread opened by that user.

All I'm asking if for your developers to install KIS 2019 on a machine with Windows 10 to try and replicate my test case.

Hi sanboxieuser456,

We don't test Kaspersky. Please, follow my previous suggestions to see if Res. Acc. Mon shows anything.

Otherwise, please reach out to the vendor to find out if they are triggering the event/monitoring anonymous logon events 

(if you post the full event, we may be able to see more info within it. The screenshot/post you provided is from years ago - which also shows this i not a new scenario. As sated, nothing has changed in Sandboxie, things run as anonymous logon as usual) .

Thanks!

Hi Barbara.

I would appreciate it if you take me more seriously.

The post I linked to is not "from years ago", it's from last March, the user went on the old Sandboxie forum to report the problem but the forums are down, I have no way to see what feedback he received.

Is there a way for you to find the thread opened by the user three months ago for me to have more input on the problem, ideally something more than a workaround accompanied with a warning, "Before you make these changes, we recommend that you evaluate the risks that are associated with implementing this workaround"?

Thank you.

Hi sandboxieuser456,

This thread:
https://www.tenforums.com/general-support/84319-event-id-6033-lsa-lsasrv.html

is from 2017 (I am going by the first post, the one that contains the message - showing it is not something new).
Sorry for any misunderstandings. And no, I don't have access to the old forums, they are still down unfortunately.

Please, let me know how it goes after following the previously provided ideas.

Regards,

Hi sandboxieuser456 ,

When I inquired about the May windows update, I assumed you just upgraded to Win10 like most people do. I was thinking perhaps some remnants of Win7 might be left over that could be causing the error. However, I just noticed in your original post you mentioned doing a clean install. I was asking because of the KB4499175 update has been problematic with some anti-virus software but this of course wouldn't effect you on a clean install. I use CIS and Comodo is not effected by the update.

The LsaSrv error is caused from running a sever and the only 2 server items I have running is Intel Turbo Booster and Sandboxie. The Intel software is installed on your system and not in the BIOS. The preliminary research is to attempt to find commonalities between our machines.

So far today and yesterday, I have not experienced any errors yet. On Friday, I'm going to update SB to v5.30 and see if the LsaSrv error comes back. Time will tell.

If you have the time, have your thought about doing a fresh install again and run SB at v5.28 to see if the errors happen? The v5.28 was a part of the image and I don't have another copy but maybe Barbara can get a copy for you to test with. Worse case, I do have v5.26 but the other version would offer better results.

Hi sandboxieuser456 ,

When I inquired about the May windows update, I assumed you just upgraded to Win10 like most people do. I was thinking perhaps some remnants of Win7 might be left over that could be causing the error. However, I just noticed in your original post you mentioned doing a clean install. I was asking because of the KB4499175 update has been problematic with some anti-virus software but this of course wouldn't effect you on a clean install. I use CIS and Comodo is not effected by the update.

The LsaSrv error is caused from running a sever and the only 2 server items I have running is Intel Turbo Booster and Sandboxie. The Intel software is installed on your system and not in the BIOS. The preliminary research is to attempt to find commonalities between our machines.

So far today and yesterday, I have not experienced any errors yet. On Friday, I'm going to update SB to v5.30 and see if the LsaSrv error comes back. Time will tell.

If you have the time, have your thought about doing a fresh install again and run SB at v5.28 to see if the errors happen? The v5.28 was a part of the image and I don't have another copy but maybe Barbara can get a copy for you to test with. Worse case, I do have v5.26 but the other version would offer better results.

Hi Sam.

I don't have Intel Turbo Booster installed.

Unfortunately this is PC #1 of 5 which I have to format so I have no time to clean install to test v5.28 out.

In my case I believe it's a conflict with KIS because with KIS turned off, I get no events.

Hi sandboxieuser456,

I'm glad you found the culprit and hopefully will find its solution.

Hopefully, in a couple of days I'll have a solution too.

Good luck

I just got another LsaSrv error a little over an hour ago. So I know this is not related to v5.30 or the May update.

Now it likely comes down to Intel Turbo Booster Technology or Sandboxie. These are the only "server" software running on my system.

I uninstalled the Intel software and will wait a couple of days to see if the error is generated.

EDIT: I have not updated Sandboxie or windows yet.

Hi Sam.

Do you get them at random or as it's in my case when you load your browser(or another application) in Sandboxie mode?

Hi sandboxieuser456,

I have been trying hard to duplicate this on purpose but without any luck. It appears random but I should know something more in a couple of days.

The only thing left on my system that could trigger this event is Sandboxie. So we'll see.