Event 10036 in Windows Server System log - Microsoft hardening DCOM (4329046)

Event 10036 in Windows Server System log - Microsoft hardening DCOM

Started to receive event 10036 in windows server system logs as below. The server-side authentication level policy does not allow the user [USERNAME]\svcSASafeguard SID (x-x-x-xx-xxxxxxxxx-xxxxxxxxxxx-xxxxxxxxxx-xxxxxx) from address [IPADDRESS] to activate DCOM server. Please raise the activation authentication level at least to RPC_C_AUTHN_LEVEL_PKT_INTEGRITY in client application.

This is down to Microsoft hardening DCOM

This is currently a warning as per link below from Microsoft

https://support.microsoft.com/en-us/topic/kb5004442-manage-changes-for-windows-dcom-server-security-feature-bypass-cve-2021-26414-f1400b52-c141-43d2-941e-37ed901c769c

According to Microsoft:

Update release	Behavior change
June 8, 2021	Hardening changes disabled by default but with the ability to enable them using a registry key.
Q1 2022	Hardening changes enabled by default but with the ability to disable them using a registry key.
Q2 2022	Hardening changes enabled by default with no ability to disable them. By this point, you must resolve any compatibility issues with the hardening changes and applications in your environment.

As it currently stands after Q2 2022 there is no possibility to disable this option.

RESOLUTION:

Install the SPP OS Patch referenced in KB 338064 to address this issue.

 

WORKAROUND

Please use the WinRM Platform instead. It can be changed by modifying the Asset, selecting Management, Product, then choosing Windows Server (WinRM).

This feature was introduced in 6.11. Please upgrade to this version or later to have this option in the platform list.

288859