Event ID 10036 appears in the Windows System log of the Commander application server

Title

Problem

Microsoft began a process to harden the security around their Distributed Component Object Model (DCOM) in June 2021, and this technology will be fully disabled as of March 14th, 2023. Snow Commander versions prior to 9.4 included functionality which relied on DCOM, and if you have not updated Commander to version 9.4 you may see errors similar to the following in your Windows System log:

Event ID	Message
10036	The server-side authentication level policy does not allow the user %1\%2 SID (%3) from address 127.0.0.1 to activate the DCOM server. Please raise the activation authentication level at least to RPC_C_AUTHN_LEVEL_PKT_INTEGRITY in client application.

These events were added by Microsoft to help administrators identify compatibility issues with DCOM authentication hardening changes. See this Microsoft article for more information.

Solution

You are see these events because Commander is trying to run guest OS steps against Windows VMs and the VMware Tools is not installed or not functioning as expected. Prior to Commander 9.4, when VMware Tools was not reachable, Commander would fall back to WMI/DCOM to execute the guest OS steps. To do so, the connection was locally proxied on the Commander application server, which is why the loopback address (127.0.0.1) may appear in the message. If you see these events without the loopback address, the IP address shown will be the target VM against which you are trying to run the Guest OS steps.

To resolve, make sure that VMware Tools is installed and functioning properly on all Windows VMs you deploy. This is best done by including these in the master image used for the Service in the Service Catalog. You can identify VMs with VMware Tools issues by following the procedure below:

Login to Commander as superuser.
Browse to Tools > Search.
Configure the search as follows:
- Help Me Find: VMs
- Location: Global
- Guest OS Family > is > Windows
- Status (Guest Tools) > isn't > OK
- Power State > is > Running

Click Search.
The results return a list of VMs that are powered on but which are not reporting that VMware Tools are running normally.

Note that this may not find all VMs that have issues. Commander can only determine if there are issues with VMware Tools if the VM is running. As such you may need to run this search a few times before you catch everything. If you have a lot of workflows for Windows VMs that contain Guest OS steps, consider scheduling this search on a weekly basis to keep ahead of potential issues.

Was this helpful?

Support Hub

Product

Snow Commander

Solution Area

Guest OS Scan

Deployment type

On-premises

Visibility

Guest

URL Name

Event-ID-10036-appears-in-the-Windows-System-log-of-the-Commander-application-server

Are you sure you want to cancel the case creation?

Case closed successfully

Action performed successfully

Upload Attachment

Maximum file size allowed is 3 MB.

File type not supported.

Supported file types:

Documents (.txt, .doc, .docx, .pdf), Images (.jpg, .png), Comma Separated Files (.csv) Speadsheets (.xlsx, .xls)

Are you sure you want to close this case

Get Hotline support

Products	Region	Phone Numbers
FlexNet Operations FlexNet Embedded FlexNet Publisher FlexNet Connect FlexNet Code Insight InstallAnywhere InstallShield	North America *	+1 630-332-2513 (toll) +1 877-279-2853 (toll-free in North America)
	Europe *	+44 1925 944367 (toll) +44 800 047 8642 (toll-free in Europe)
	Japan *	+81 3-4540-5335 (select option 2)
	Australia *	+61 3 9895 2177 +61 1800 560 603 (toll-free in Australia)
Usage Intelligence (formerly Revulytics) Compliance Intelligence	Please use the Case Portal to submit your support ticket or reach out to your Revenera contact.

Problem

Solution

Related Articles

Please wait...

Case id: 00001065