Event ID : 10036 DistributedCOM

Question

Hello !

Since I performed the KB5012170 update on my server, I get the following error: "The server-side authentication level policy does not allow the user ********** SID (xxxxxxx) from address xxxxxx to activate DCOM server. Please raise the activation authentication level at least to RPC_C_AUTHN_LEVEL_PKT_INTEGRITY in client application.
I have seen on various web pages that the latest Microsoft KBs increase security at the DCOM level.

The following topic: https://support.microsoft.com/en-us/topic/kb5004442-manage-changes-for-windows-dcom-server-security-feature-bypass-cve-2021-26414-f1400b52-c141-43d2-941e-37ed901c769c explains how to work around the problem, it is noted that it is necessary to disable HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat, "RequireIntegrityActivationAuthenticationLevel" only it is not present when I search on the server.

Can you help me to correct this error?

Answer 1

only it is not present when I search on the server

It wouldn't exist by default. You can navigate to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat
then create a DWord named
RequireIntegrityActivationAuthenticationLevel
and set it's value to 0 (zero) to disable.

--please don't forget to upvote and Accept as answer if the reply is helpful--