INFORMATICS

The Best

Windows patch KB5014692 breaks WMI for User-ID

Star InactiveStar InactiveStar InactiveStar InactiveStar Inactive

Environment:

  • Microsoft Windows Server 2019 with patch KB5014692 applied

Note: WMI (Windows Management Instrumentation) is configured under GUI: Device > User Identification > User Mapping > Server Monitoring > Transport Protocol: 'WMI'

Cause
On June 14, 2022, Microsoft released patch KB5004442 for Windows Server to address the vulnerability described in CVE-2021-26414. This patch enables new 'hardened security' for WMI and is having an impact on all vendors.

Info from Microsoft: KB5004442—Manage changes for Windows DCOM Server Security Feature Bypass (CVE-2021-26414)


Resolution

  1. The permanent solution is to switch to WinRM as the transport protocol instead of WMI. 

  1. A temporary workaround is available until March 14, 2023. On the Windows Server, follow Microsoft's instructions to disable the hardening change. Modify the following registry value and set it to disabled:
Path : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat
Value Name: "RequireIntegrityActivationAuthenticationLevel"
Type: dword
Value Data: 0x00000000 means disabled. 0x00000001 means enabled.

Note: You must enter Value Data in hexadecimal format. 
Important: You must restart your device after setting this registry key for it to take effect.
This registry key is scheduled to be removed by Microsoft on March 14, 2023 as part of their behavior change timeline.
 

KB5004442—Manage changes for Windows DCOM Server Security Feature Bypass (CVE-2021-26414)

 

Summary

The Distributed Component Object Model (DCOM) Remote Protocol is a protocol for exposing application objects using remote procedure calls (RPCs). DCOM is used for communication between the software components of networked devices.  

Hardening changes in DCOM were required for CVE-2021-26414. Therefore, we recommended that you verify if client or server applications in your environment that use DCOM or RPC work as expected with the hardening changes enabled.

To address the vulnerability described in CVE-2021-26414, you must install updates released September 14, 2021 or later on client and server computers. If you have not installed the June 14, 2022 or later update, you must also enable the registry key described below in your environment for servers. We recommended that you complete testing in your environment and enable these hardening changes as soon as possible. If you find issues during testing, you must contact the vendor for the affected client or server software for an update or workaround before early 2022.

Note We recommend that you update your devices to the latest security update available to take advantage of the advanced protections from the latest security threats.

Timeline

Update release

Behavior change

June 8, 2021

Hardening changes disabled by default but with the ability to enable them using a registry key.

June 14, 2022

Hardening changes enabled by default but with the ability to disable them using a registry key.

November 8, 2022

This update will automatically raise authentication level for all non-anonymous activation requests from DCOM clients to RPC_C_AUTHN_LEVEL_PKT_INTEGRITY if it is below Packet Integrity. With this change, most Windows DCOM client applications will automatically work with DCOM hardening change on server side without any modification to the DCOM client applications.

March 14, 2023

Hardening changes enabled by default with no ability to disable them. By this point, you must resolve any compatibility issues with the hardening changes and applications in your environment.

Registry setting to enable or disable the hardening changes

During the timeline phases in which you can enable or disable the hardening changes for CVE-2021-26414, you can use the following registry key:

  • Path : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat

  • Value Name: "RequireIntegrityActivationAuthenticationLevel"

  • Type: dword

  • Value Data: default = 0x00000000 means disabled. 0x00000001 means enabled. If this value is not defined, it will default to enabled.

Note You must enter Value Data in hexadecimal format. 

Important You must restart your device after setting this registry key for it to take effect.

Note Enabling the registry key above will make DCOM servers enforce an Authentication-Level of RPC_C_AUTHN_LEVEL_PKT_INTEGRITY or higher for activation.

Note This registry value does not exist by default; you must create it. Windows will read it if it exists and will not overwrite it.

Registry settings to raise the activation authentication level

You can use the following registry key to raise the activation authentication level.

  • Path : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat

  • Value Name: "RaiseActivationAuthenticationLevel"

  • Type: dword

  • Value Data: 1 means raise default authentication level to RPC_C_AUTHN_LEVEL_PKT_INTEGRITY.

    Two (2) means raise authentication level for all non-anonymous activation requests to RPC_C_AUTHN_LEVEL_PKT_INTEGRITY if it is below Packet Integrity. This includes the explicitly set authentication level in activation functions, such as CoCreateInstanceEx. If this value is not defined, it will default to 1 (before November 8, 2022) and 2 (after November 8, 2022).

Note You must enter Value Data in hexadecimal format. 

Important You must restart your device after setting this registry key for it to take effect.

Note This registry value does not exist by default; you must create it. Windows will read it if it exists and will not overwrite it.

New DCOM error events

To help you identify the applications that might have compatibility issues after we enable DCOM security hardening changes, we added new DCOM error events in the System log; see the tables below. The system will log these events if it detects that a DCOM client application is trying to activate a DCOM server using an authentication level that is less than RPC_C_AUTHN_LEVEL_PKT_INTEGRITY. You can trace to the client device from the server-side event log and use client-side event logs to find the application.

Server events

Event ID

Message

10036

"The server-side authentication level policy does not allow the user %1\%2 SID (%3) from address %4 to activate DCOM server. Please raise the activation authentication level at least to RPC_C_AUTHN_LEVEL_PKT_INTEGRITY in client application."

(%1 – domain, %2 – user name, %3 – User SID, %4 – Client IP Address)

Client events

Event ID

Message

10037

"Application %1 with PID %2 is requesting to activate CLSID %3 on computer %4 with explicitly set authentication level at %5. The lowest activation authentication level required by DCOM is 5(RPC_C_AUTHN_LEVEL_PKT_INTEGRITY). To raise the activation authentication level, please contact the application vendor."

10038

"Application %1 with PID %2 is requesting to activate CLSID %3 on computer %4 with default activation authentication level at %5. The lowest activation authentication level required by DCOM is 5(RPC_C_AUTHN_LEVEL_PKT_INTEGRITY). To raise the activation authentication level, please contact the application vendor."

(%1 – Application Path, %2 – Application PID, %3 – CLSID of the COM class the application is requesting to activate, %4 – Computer Name, %5 – Value of Authentication Level)

Availability

These error events are only available for a subset of Windows versions; see the table below.

Windows version

Available on or after these dates

Windows Server 2022

September 27, 2021

KB5005619

Windows 10, version 2004, Windows 10, version 20H2, Windows 10, version 21H1

September 1, 2021

KB5005101

Windows 10, version 1909

August 26, 2021

KB5005103

Windows Server 2019, Windows 10, version  1809

August 26, 2021

KB5005102

Windows Server 2016, Windows 10, version 1607

September 14, 2021

KB5005573

Windows Server 2012 R2 and Windows 8.1

October 12, 2021

KB5006714

 

How do I delete Shortcuts from All Users desktops?

Star InactiveStar InactiveStar InactiveStar InactiveStar Inactive

 

If you're talking about the All Users desktop, it can be found here:

  • Windows Server 2003: %ALLUSERSPROFILE%\Desktop
  • Windows Server 2008 and above: %PUBLlC%\Desktop

If want to remove shortcuts from each user's desktop, then you could write a script that deletes all *.LNK files from %USERPROFILE%\Desktop, or where ever their Desktop is redirected to ( %HOMESHARE%\Desktop).

Another method

Step 1. Edit a GPO that targets the computers that you want to apply the home page setting.

Step 2. Navigate to User Configuration > Preferences > Control Panel Settings > Windows Settings

Step 3. Click on the “Action” menu and click on “New” and then click on “Shortcut”

Step 4. Change the Action to “Delete” then select “All Users Desktop” and then type “Adobe Reader 9” in the name field.

Microsoft Windows Server 2008 and 2008 R2 Maximum Memory Limits

Star InactiveStar InactiveStar InactiveStar InactiveStar Inactive

 

Microsoft Windows Server 2008 and 2008 R2 Maximum Memory Limits

Version Maximum Memory Limit (x64 Only)
Windows Server 2008 R2 Datacenter

2TB

Windows Server 2008 R2 Enterprise 2TB
Windows Server 2008 R2 for Itanium 2TB
Windows Server 2008 R2 Foundation 8GB
Windows Server 2008 R2 Standard 32GB
Windows Web Server 2008 R2 32GB

 

Version Max Memory Limit (x32) Max Memory Limit (x64)
Windows Server 2008 Datacenter 64GB 2TB
Windows Server 2008 Enterprise 64GB 2TB
Windows Server 2008 Standard 4GB 32GB
Windows Small Business Server 2008 4GB 32GB
Windows Web Server 2008 4GB 32GB

Locations of the registry files in Windows 2008 R2

Star InactiveStar InactiveStar InactiveStar InactiveStar Inactive

Locations of the registry files in Windows 2008 R2

HKLM\Security - %windir%\system32\config\SECURITY

HKLM\System - %windir%\system32\config\SYSTEM

HKLM\Software - %windir%\system32\config\SOFTWARE

HKLM\Components - %windir%\system32\config\COMPONENTS

HKLM\Sam - %windir%\system32\config\SAM
HKEY_USERS.DEFAULT - %windir%\system32\config\Default
HKEY_USERS\[SID] - %userprofile%\Ntuser.dat
HKCU\[SID]\Software\Classes - %userprofile%\AppData\Local\Microsoft\Windows\Usrclass.dat

Search