0

I'm trying to retrieve a WMI objects on a remote machine using the following powershell code :

Get-WmiObject -ComputerName mymachine -class Win32_operatingSystem -Authentication PacketIntegrity

However, as the KB5004442(https://support.microsoft.com/en-us/topic/kb5004442-manage-changes-for-windows-dcom-server-security-feature-bypass-cve-2021-26414-f1400b52-c141-43d2-941e-37ed901c769c) is installed and activated on my computer (RequireIntegrityActivationAuthenticationLevel registry key set to 1), I get an "Access denied" error.

In the event viewer on the server side, I can see the related error 10036 : The server-side authentication level policy does not allow the user %1\%2 SID (%3) from address %4 to activate DCOM server. Please raise the activation authentication level at least to RPC_C_AUTHN_LEVEL_PKT_INTEGRITY in client application

From my point of view, specify "PacketIntegrity" as the authentication level should have done the trick (I've always tried with the PacketPrivacy level)

When disabling the KB (setting RequireIntegrityActivationAuthenticationLevel to 0 and reboot), the command works perfectly.

I've always tried to make this call using VBscript with the same result GetObject("winmgmts:authenticationLevel=packetIntegrity}!\\mymachine\Root\CIMv2")

My objective here is to be able to continue to request WMI objects after March 14, 2023 when it will be impossible to disable the KB5004442.

nmariot
  • 51
  • 3

0 Answers0