Share via

Code Integrity

Anonymous
2024-11-15T04:34:58+00:00

I run SentinelOne as my EDR, however, I keep getting the below error on my syslog server. I reached out to SentinelOne and they say, many of their customers have complained about this, but they have no work around as it is Microsoft related issue. Can someone help me resolve this so I doesnt keep getting logged, if it is not something to worry about?

Regards,

11-14-2024 20:21:58 User.Error DESKTOP-*********** Nov 14 22:21:58 DESKTOP-*********.internal MSWinEventLog 3 Microsoft-Windows-CodeIntegrity/Operational 798988 Thu Nov 14 22:21:53 2024 3033 Microsoft-Windows-CodeIntegrity S-1-5-20 N/A Error DESKTOP-*********.internal 1 Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\SentinelOne\Sentinel Agent 23.2.3.358\SentinelAmsi64.dll that did not meet the Windows signing level requirements.

Windows for home | Windows 11 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2024-11-16T02:54:53+00:00

    Hi Lazy Admin

    Welcome to Microsoft Community.

    Based on your description, I understand that you are running Sentinel as an EDR, but the syslog server keeps prompting errors, and I understand very well how you feel!

    I carefully analyzed the detailed error you gave, generally speaking the code integrity function is used to verify the integrity of a driver or file when it is loaded into memory. And it is mainly used to detect whether the driver or file has a legal signature or not.

    If I just look at the error message you provided, the generalization is that when “svchost.exe” tries to load the “SentinelAmsi64.dll” file from the SentinelOne agent, the file does not meet the Windows signature level requirements.

    I understand the situation bro, I had a similar problem when I was monitoring services and devices with zabbix. Don't worry though, sometimes this type of error is benign. And actually the signature issue needs some tweaking or patching by the developer for code integrity GPOs & other stuff & it will go away.

    Personally, I have the following two suggestions:

    1. If you find it troublesome that this error message appears frequently, you can force disable digital signature authentication via command line.

    1)Click “Windows Logo Key” to open the search bar -> Type “cmd” in the search bar and open it with administrator privileges -> Please enter the following command

    bcdedit.exe /set nointegritychecks on

bcdedit /set {current} testsigning on
    1. Disable Driver Signature Enforcement (Advanced Startup) (turn it off briefly, it will be automatic after the next reboot)

    (1) First press Win+I to open Settings.

    (2) Click on “Update & Security” and then “Recovery”.

    (3) In the “Advanced Boot” section, click “Restart Now”.

    (4) The computer will be taken to the advanced startup options. Here, select “Troubleshooting”.

    (5) Next, select “Advanced Options”.

    (6) In the advanced options, select “Startup Settings”.

    (7) In Startup Settings, click on Restart.

    (8) The computer will restart and display the startup settings. Here, find the option “Disable Driver Signature Enforcement” and press the corresponding number key (usually 7).

    (9) The computer will continue to boot and driver signature enforcement will be disabled.

    But personally I don't really recommend it from a technical point of view with my own situation. Because the digital signature verification can sometimes help us to understand that some may not meet the requirements of the process or file into the kernel, and sometimes even help us to see the signs of hacking although the probability of this is relatively small.

    Assuming that there are times when we have to adjust services, pull away data, and other operations, we can use Method 2 to briefly disable it once.

    1. I would recommend ignoring this benign information for now and setting up some filters on the syslog server to filter this information or place it in several places.

    Filtering keywords should be specific to prevent other similar messages from being filtered or placed together.

    I sincerely hope that the above solution will solve your problem. Please feel free to contact me if you have any problems or still can't solve them. (Photos related to the question would be great!).

    I look forward to hearing back from you. 

    Best Regards

    Arthur Sheng | Microsoft Community Support Specialist

    0 comments