DCOM authentication hardening: what you need to know

ZappBrannigan145 WarrenStanley As mentioned in the updated KB Article, there're two minor client-side updates after Nov update on some Windows platforms. To make thing simple, we recommend users to install Jan 2023 update. With Jan 2023 update installed, RaiseActivationAuthenticationLevel is no longer needed for Windows Server 2016 and Windows Server 2019. People can actually unintentionally turn off auto-promotion of authentication level if it is set to a wrong value, that's why the description of the registry key is removed from the KB Article. ZappBrannigan145 KB5023788 is not the March cumulative security update, it's the servicing stack update. KB5023697 is the March cumulative security update. I'm not sure how reverting KB5023788 works for you. Anyway, I recommend you install KB5022838 the Feb cumulative security update on your Windows server 2016 machines, and look for Distributed-COM error event 10036 in Event Viewer. The message in the event should tell you the client that is triggering the error event. Go to the client machine, check if Jan 2023 update is installed on the machine. If it is not, install the Jan 2023 update on the client machine, do your test, and check on the server again if event 10036 triggered by that client is gone. If you have out-of-service client machines in your environment that can't be patched, then those client machines won't be able to connect to server any more once March cumulative security update is installed on the server. You'll either need to upgrade to a Windows version that's still in support, or you'll need to raise the authentication level in your application itself.