-
Titel
Event 10036 in Windows Server System log - Microsoft hardening DCOM -
Beschreibung
Started to receive event 10036 in windows server system logs as below. The server-side authentication level policy does not allow the user [USERNAME]\svcSASafeguard SID (x-x-x-xx-xxxxxxxxx-xxxxxxxxxxx-xxxxxxxxxx-xxxxxx) from address [IPADDRESS] to activate DCOM server. Please raise the activation authentication level at least to RPC_C_AUTHN_LEVEL_PKT_INTEGRITY in client application. -
Ursache
This is down to Microsoft hardening DCOM
This is currently a warning as per link below from MicrosoftAccording to Microsoft:
Update release
Behavior change
June 8, 2021
Hardening changes disabled by default but with the ability to enable them using a registry key.
Q1 2022
Hardening changes enabled by default but with the ability to disable them using a registry key.
Q2 2022
Hardening changes enabled by default with no ability to disable them. By this point, you must resolve any compatibility issues with the hardening changes and applications in your environment.
As it currently stands after Q2 2022 there is no possibility to disable this option.
-
Lösung
RESOLUTION:
Install the SPP OS Patch referenced in KB 338064 to address this issue.
WORKAROUND
Please use the WinRM Platform instead. It can be changed by modifying the Asset, selecting Management, Product, then choosing Windows Server (WinRM).
This feature was introduced in 6.11. Please upgrade to this version or later to have this option in the platform list.
-
Änderungsanforderung
288859