KB5004442 - Windows DCOM Server Security Feature Bypass (CVE-2021-26414) having issue

shiv raj kr 1 Reputation point
2021-10-21T09:57:50.067+00:00

After enabling the registry followed by the below doc. we are facing issues as access denied even after using RPC_C_AUTHN_LEVEL_PKT_INTEGRITY on WMI.

Windows Server 2019 Version 1809 (OS build 17763.2268). windows updated KB5006744

https://support.microsoft.com/en-us/topic/kb5004442-manage-changes-for-windows-dcom-server-security-feature-bypass-cve-2021-26414-f1400b52-c141-43d2-941e-37ed901c769c

Windows Server 2019
Windows Server 2019
A Microsoft server operating system that supports enterprise-level management updated to data storage.
3,443 questions
Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,081 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,818 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Dave Patrick 426K Reputation points MVP
    2021-10-21T12:50:29.16+00:00

    What value did you set?
    Value Data: default = not defined or 0x00000000 means disabled. 0x00000001 = enabled.

    Looks like you'll want 0 to disable it.

    --please don't forget to upvote and Accept as answer if the reply is helpful--

  2. Dave Patrick 426K Reputation points MVP
    2021-10-21T18:22:10.333+00:00

    Sounds like the calling process doesn't have the correct Authentication-Level
    https://learn.microsoft.com/en-us/windows/win32/wmisdk/securing-a-remote-wmi-connection
    https://learn.microsoft.com/en-us/windows/win32/rpc/authentication-level-constants

    --please don't forget to upvote and Accept as answer if the reply is helpful--