Missing registry for issue of Windows patch KB5014692 which breaks WMI for User-ID
Environment
- Palo Alto Firewall
- WMI enabled on Integrated User-ID
- Microsoft Windows Server with patch KB5014692 applied
Cause
On June 14, 2022, Microsoft released patch KB5004442 for Windows Server to address the vulnerability described in CVE-2021-26414. This patch enables new 'hardened security' for WMI and is having an impact on all vendors.
Info from Microsoft: KB5004442—Manage changes for Windows DCOM Server Security Feature Bypass (CVE-2021-26414)
Resolution
A permanent fix is to switch to WinRM as the transport protocol instead of WMI. But the temporary workaround is available until March 14, 2023. On the Windows Server, follow Microsoft's instructions to disable the hardening change. Modify the following registry value and set it to disabled:
Path : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat
Value Name: "RequireIntegrityActivationAuthenticationLevel"
Type: dword
Value Data: 0x00000000 means disabled. 0x00000001 means enabled.
Note: You must enter Value Data in hexadecimal format.
** If you do not see the mentioned registry value in mentioned path "Path : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat" then manually creating a new registry value at same path should work. You must restart your device after setting this registry key for it to take effect.