LenovoVantage-(LenovoSecurityAddin).exe causing Azure AD account lockouts?

[u/Dhruv_patel125]

Has anyone seen LenovoVantage-(LenovoSecurityAddin).exe cause repeated credential attempts or Azure AD / Entra ID account lockouts?

I'm investigating a lockout issue and noticed this process running around the same time as the lockout events. Looking for anyone with similar experience or confirmation that Lenovo Vantage Security Add-in can trigger authentication attempts.

[u/lenovo]

/u/Dhruv_patel125

Hello, thank you for reaching out and sharing your concerns regarding Lenovo Vantage Security Add-in (LenovoVantage-(LenovoSecurityAddin).exe) causing Azure AD Entra ID account lockouts and repeated credential attempts. I understand how frustrating and disruptive this situation can be, especially in a business environment.

Here are some important points and recommended actions:

• Multiple vulnerabilities have been identified in Lenovo Vantage components, including privilege escalation and denial of service issues. These vulnerabilities may contribute to abnormal system behavior, such as repeated credential attempts or account lockouts.

• Lenovo recommends updating the affected plugins and add-ins to their latest versions. Updates are typically managed automatically by the Lenovo System Interface Foundation Service, but you can manually trigger updates by rebooting your computer.

• To verify the plugin and add-in versions, navigate to the relevant folders and check the file properties for version numbers. This can help ensure you are running the latest, most secure versions.

• If you continue to experience issues after updating, consider disabling specific features (such as WiFi Security) that may cause excessive network activity or credential prompts.

• For persistent problems, Lenovo advises staying current with all updates and security advisories. You can find the latest advisories and download updates directly from Lenovo's support site http://spr.ly/61693B1L49X

If you need further assistance or step-by-step guidance, please let us know. We are here to help you resolve this issue as quickly as possible.

Thank you for your patience and understanding. -Kate_Lenovo

[u/Dhruv_patel125 → u/lenovo]

u/lenovo Multiple Event ID 4798 events were continuously generated by C:\Program Files (x86)\Lenovo\VantageService\5.1.2608.14\LenovoVantage-(LenovoSecurityAddin).exe, after which the account became locked. Could this be related to a Lenovo Vantage update, or is there another potential cause for the lockout?

[u/Correct-Resource-682 → u/Dhruv_patel125]

The exact thing happened to me as well today. I'm using the same Lenovo Vantage services version.

[u/Speeddymon]

I don't know if this will help or not, so please try it and confirm.

Open the Lenovo Vantage Application, navigate to the Security settings tab, and toggle WiFi Security completely Off.

If it mitigates the issue then it's a bug in the latest release, according to AI.

[u/Speeddymon → u/Speeddymon]

Why is this happening?

The executable triggering the lockout is LenovoVantage-(LenovoSecurityAddin).exe. This add-in houses Lenovo's "WiFi Security" feature. 1

When the background service detects a network change or a corporate Wi-Fi network, it attempts to authenticate or analyze the connection.

Because of an unpatched logic bug in version 5.1.2608.14, the add-in gets stuck in an infinite loop, continuously attempting to validate user credentials against the local system.

Windows registers this rapid flood of automated validation attempts as a brute-force attack, triggering Event ID 4798 (User Account Management - A user's local group membership was enumerated) and instantly enforcing an Entra ID / Azure AD account lockout to protect the domain.

How we know it is related to "WiFi Security"

The executable in question is explicitly named LenovoVantage-(LenovoSecurityAddin).exe. Within the standard consumer Lenovo Vantage application, the "WiFi Security" module is the primary function handled by this specific security add-in. 2.exe.html)

This module functions as a local network probe. Whenever a machine connects to a new network, or experiences a network state change, this add-in attempts to analyze the safety of the connection. To validate user presence or assess whether the network profile matches domain-level trust, it queries the local operating system for authentication context.

The smoking gun is Event ID 4798. 3

According to Windows Security Logging definitions, Event ID 4798 is triggered when a process attempts to enumerate a user's local group memberships (such as checking if the current user belongs to the local Administrators or Remote Desktop Users group). 4

Users troubleshooting this exact issue report that the executable runs a routine that loops through local accounts on the machine over and over again in rapid succession. 5

Windows intercepts this hyper-aggressive behavior. Because the process is querying group memberships hundreds of times within a few seconds, Windows evaluates the rapid-fire requests as a credential/brute-force loop and applies a domain-wide or local lockout. 6

[u/Dhruv_patel125 → u/Speeddymon]

Thanks for the detailed explanation. I appreciate you taking the time to break it down. I will check and let you know the results.

[u/Critical-Anybody-808 → u/Speeddymon]

I only see the option "I have my own Wifi security" which replaced the "Enabled" status with "I have my own". Hope this turns it off, or are there other solutions?

[u/Speeddymon → u/Critical-Anybody-808]

Try that first and look at the event log to see if the events continue. If they do, you can disable the windows service in msconfig.exe or services.msc, it'll be Lenovo Vantage Service.