Uploaded image for project: 'Observium'
  1. Observium
  2. OBS-4422

WMI changing on Windows server for DCOM Hardening

    XMLWordPrintable

Details

    • Bug
    • Resolution: Unresolved
    • Major
    • None
    • Professional Edition
    • Poller

    Description

      On 14th of March 2023 Microsoft is changing its DCOM hardening policy which when is set to Microsoft guidance will break the WMI poller.

       

      Information is here KB5004442—Manage changes for Windows DCOM Server Security Feature Bypass (CVE-2021-26414) - Microsoft Support

       

      Currently we are able to bypass this issue by changing the settings on the windows servers as below, but this becomes obsolete on 14th of March 2023

       

      • Path : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat
      • Value Name: "RequireIntegrityActivationAuthenticationLevel"
      • Type: dword
      • Value Data: default = 0x00000000 means disabled. 0x00000001 means enabled. If this value is not defined, it will default to enabled.

       

      I'm unsure what if anything can be done inside Observium to handle this issue.

      Attachments

        Activity

          People

            landy Mike Stupalov
            meaton Michael Eaton
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated: