Multiple error event 10036 logged in all domains joined computer and servers.

Question

Multiple error event 10036 logged in all domains joined computer and servers.

EnterpriseArchitect 6,041

I need some help and explanation as to why explain why all my Windows Servers and Workstations are logging this event multiple times daily.

Log Name:      System
Source:        Microsoft-Windows-DistributedCOM
Date:          16/01/2024 1:22:26 AM
Event ID:      10036
Task Category: None
Level:         Error
Keywords:      Classic

The server-side authentication level policy does not allow the user DOMAIN\FireWall-SVC (S-1-5-21-UNIQUE-GUID) from address 172.11.56.13 to activate DCOM server. Please raise the activation authentication level at least to RPC_C_AUTHN_LEVEL_PKT_INTEGRITY in client application.

This happens to all computers daily more than once.

1 answer

Your answer

Answer 1

Thameur-BOURBITA 36,261 Moderator

Hi @EnterpriseArchitect

Please take a look at this KB:

https://support.microsoft.com/en-us/topic/kb5004442-manage-changes-for-windows-dcom-server-security-feature-bypass-cve-2021-26414-f1400b52-c141-43d2-941e-37ed901c769c

Please don't forget to accept helpful answer

Wesley Li 11,275 Reputation points

2024-01-16T09:24:00.6533333+00:00

Hello The error you’re seeing, Event ID 10036 from Microsoft-Windows-DistributedCOM, is likely related to changes in Windows security hardening techniques applied on Windows updates1. This error is typically logged when the server-side authentication level policy does not allow a user to activate a DCOM server. The error message suggests raising the activation authentication level at least to RPC_C_AUTHN_LEVEL_PKT_INTEGRITY in the client application. This is a security measure to ensure that only authenticated users can activate the DCOM server. One common workaround for this issue is to modify the registry. You can navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat and create a DWORD named RequireIntegrityActivationAuthenticationLevel. Set its value to 0 (zero) to disable the requirement. However, please note that this action might lower the security level of your system. If you don’t want to disable the hardening change, you might need to update the DCOM application or contact the developer for further assistance. Best Regards, Wesley Li

If the Answer is helpful, please click "Accept Answer" and upvote it.

Share via

Multiple error event 10036 logged in all domains joined computer and servers.

1 answer

Your answer