DCOM Hardening: Different Versions of Windows

Copper Contributor

My version is win10 19042.

when i try to execute any wmi command in my domain; (such as;  wmic /node:IPADDR computersystem get username )

If server and client versions are the same, command success;   (Windows 10 19042)

If server and client versions are different; (Win10 19044, Win10 19042) it gives an error:

 

The server-side authentication level policy does not allow the user domain\User SID (xxx) from address x.x.x.x to activate DCOM server. Please raise the activation authentication level at least to RPC_C_AUTHN_LEVEL_PKT_INTEGRITY in client application.

 

I also created the registry key named "RequireIntegrityActivationAuthenticationLevel" on the remote computer and set its value to 0 but it doesn't affect it and gives the same error.


How to overcome this situation except upgrade all remote computers?

1 Reply

@OS_Turkey 

Using IP-ADDR does only work for me, if there is a correct DNS PTR. Does it work with hostname and/or FQDN?