WMI collection fails and results in DCOM errors after applying Microsoft Windows Update June 8, 2021—KB5003638 (OS Build 14393.4467).

Articoli tecnici ID: KB94640
Ultima modifica: 7/23/2021

Ambiente

McAfee SIEM Enterprise Security Manager (ESM) 11.x
McAfee SIEM Event Receiver (Receiver) 11.x

Riepilogo

This article discusses an issue that can occur on the ESM and Receiver, which can prevent collection of WMI logs.

Problema

After you apply Microsoft Windows Update June 8, 2021—KB5003638 (OS Build 14393.4467), the SIEM WMI collector is unable to connect to the WMI service to pull logs. DCOM errors are observed in the Receiver /var/log/wmin.log:

w/ NTStatus: NT_STATUS_CONNECTION_REFUSED - NT_STATUS_CONNECTION_REFUSED
w/ NTStatus: NT_STATUS_ACCESS_DENIED - Access denied

Affected operating systems include the following Windows editions and later:

Windows 10, version 1607, and all editions of Windows Server 2016.

Causa

Security enhancements implemented in Microsoft Update June 8, 2021—KB5003638 (OS Build 14393.4467) impacts the IWbemServices_ExecQuery Windows Event API when using RPC for the connection between the SIEM receiver and the Windows data source.

Soluzione

Solution 1—Disable RPC
Deselecting Use RPC in the data source settings changes the connection method for collecting WMI records from the SIEM receiver. To implement this change:

Open the properties for the data source.
Find the Use RPC checkbox and deselect it.
Write out the data source settings.
The RPC uses a different port, so it’s necessary to modify your proxy or firewall configuration. Discuss this information with your network administrator.

NOTE: If you aren’t using a local admin account to connect to the WMI data source, see KB74126 - How to use a non-Admin account for WMI for information on configuring the account.

Solution 2—SIEM Collector for Windows

Alternatively, you can use the SIEM Collector utility for Windows included in the SIEM suite (download from the Product Downloads site). Install this application on the Windows system that you’re collecting logs from. Also, the SIEM collector can also be installed on a Windows system that is used as the target for Windows Event forwarding.

See the SIEM Collector Installation Guide for more details about installing and using the SIEM Collector.

Contact Microsoft Support for additional information.

See the "Known Issues" section of the Microsoft Support article on the update for details.

Prodotti interessati

SIEM Enterprise Security Manager 11.4.x
SIEM Enterprise Security Manager 11.3.x
SIEM Enterprise Security Manager 11.2.x
SIEM Enterprise Security Manager 11.1.x
SIEM Event Receiver 11.4.x
SIEM Event Receiver 11.3.x
SIEM Event Receiver 11.2.x
SIEM Event Receiver 11.1.x

Lingue:

Questo articolo è disponibile nelle seguenti lingue:

English United States
Spanish Spain
French
Italian
Portuguese Brasileiro

Glossario dei termini tecnici

Evidenzia termini glossario

Ti consigliamo di consultare il nostro Glossario dei termini tecnici.

Knowledge Center

WMI collection fails and results in DCOM errors after applying Microsoft Windows Update June 8, 2021—KB5003638 (OS Build 14393.4467).

Ambiente

Riepilogo

Problema

Causa

Soluzione

Prodotti interessati

Lingue:

Glossario dei termini tecnici

Title

Title

Knowledge Center

WMI collection fails and results in DCOM errors after applying Microsoft Windows Update June 8, 2021—KB5003638 (OS Build 14393.4467).

Ambiente

Riepilogo

Problema

Causa

Soluzione

Prodotti interessati

Lingue:

Glossario dei termini tecnici

Scegli la regione

Title

Title