Server 2022 Windows Updates January 2025 | System Guard Runtime Monitor Broker Service

Question

Hello Community, we see on different Customers following after install the January 2025 Updates.

Windows Could not start the System Guard Runtime Monitor Broker service on local Computer on Server 2022.

Others also face the problem?

br

Johannes

Answer 1

Hello Community, we see on different Customers following after install the January 2025 Updates.

Windows Could not start the System Guard Runtime Monitor Broker service on local Computer on Server 2022.

Others also face the problem?

br

Johannes

Hi Johannes,

We have had a discussion with MS support and received following update from them. This service is no longer serving any purpose and going to be removed from the OS with following month windows updates.

"I understand that you are experiencing issues with the System Guard Runtime Monitor Broker service on your Windows Server 2022 systems after installing the January updates. It is important to note that the System Guard Runtime Monitor Broker service was intentionally disabled by default on Windows Server 2022 by updates released on and after January 14, 2025. This may result in the service failing to start or being terminated when an attempt is made to start it. The Service Control Manager may log an error indicating that the service terminated with a specific error code (event 7023) in the System event log.

Future Windows Updates are expected to remove the System Guard Runtime Monitor Broker service from Windows Server 2022, as it is not serving any purpose for consumer or enterprise customers. Administrators are advised to avoid attempting to enable or start this service until it is programmatically removed by a future update."

Answer 2

Hello Mittelboeck Johannes,

thank you for posting on the Microsoft Community Forums.

Here are some steps you can take to troubleshoot and potentially resolve this issue:

1. Check Permissions: Make sure you have the necessary permissions to start the service. You might need administrative privileges to start it.
2. Run Services as Administrator:
   • Open the Services management console as an administrator:
     • Press Win + R, type services.msc, and press Ctrl + Shift + Enter to run it as an administrator.
3. Check for Updates: Make sure all Windows updates have been successfully installed. Sometimes, additional updates are released to fix issues introduced by previous updates.
4. Check Service Dependencies: Ensure all dependent services are running. In the properties of "System Guard Runtime Monitor Broker," look under the Dependencies tab to see which services it depends on and verify that they are running.
5. Run System File Checker:
   • There might be corrupted system files causing this issue. You can run the System File Checker tool to scan and repair them.
     • Open Command Prompt as an administrator and run:
   sfc /scannow
6. Check Group Policy Settings:
   • Ensure that there are no group policies that are preventing the service from starting.
     • Open the Group Policy Editor (gpedit.msc) and navigate to Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment.
7. Reset Permissions:
   • Open Command Prompt as an administrator and execute the following commands to reset permissions:
   icacls C:\Windows\System32\SGMBroker.exe /grant administrators:F

Hope it helps.

Kind regards,

Lei

Answer 3

Hi Lei,

no doesnt help. We see this problem on many Server 2022 on different Infrastrucutres. Also on Windows 10.

Error 7023 Service Control Manager....System Guard Runtime Monitor - Microsoft Community

br

Johannes

Answer 4

Hi there

It seem´s that some of 2025 Jan patches simply changed this service startup from "Manual (Triggered)" to "Auto (Delayed)".

Let´s wait for MS to update us if this is an expected behavior......

I noticed this because our zabbix started to pop up alert´s for this service after some of our customers received Updates. Our Zabbix monitor only services that have startup Auto and there´s no status of this service previously to update cycle, so it was added to zabbix on detection cycle and alarmed since then.