Managing Windows DCOM Hardening

Hardening changes in DCOM server are required by CVE-2021-26414. These changes will have an impact on client and server applications that use DCOM or RPC.
For more information about the timeline phases, see the Microsoft documentation: KB5004442—Manage changes for Windows DCOM Server Security Feature Bypass (CVE-2021-26414)

To allow that all the OPC components can work both with or without enabling the hardening changes DCOM configuration of the environment as well as of the various Desigo CC OPC DA components must be carried out.
NOTE: These configuration changes must be applied only if the interaction between applications is to be carried out between remote machines.

For the communication between OPC DA components to be established, all the OPC components must be able to support the hardening changes in DCOM.
Therefore, this functionality must be enabled only after all the configuration changes required by Desigo CC as well as by the third-party OPC DA components have been made.
The configuration required by third-party OPC DA components will vary based on the OPC DA component in use. For instructions, see the documentation of your third-party OPC DA component.

Prerequisites

 

Please be aware that the OPC DA discovery feature released with the current version of the Desigo CC software—by default—behaves like the hardening changes were enabled. You can intentionally enable or disable the DCOM hardening according to your needs. See the instructions below.
Note that to guarantee the correct operation of the OPC DA discovery functionality, after the last Microsoft timeline, the registry key (RequireIntegrityActivationAuthenticationLevel) must be set to 1 or deleted.

 

Disabling Hardening Changes

To disable the hardening changes, modify the following registry key on all the machines:

  1. In the Windows search box on the taskbar, enter REGEDIT to open Registry Editor.
  1. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat.
  1. Do one of the following:
  • If the value is already present, select RequireIntegrityActivationAuthenticationLevel.
  • If the value is not already present, create it (right-click AppCompat and select DWORD (32-bit) Value) and then select RequireIntegrityActivationAuthenticationLevel.
  1. To modify the registry key value data, do the following:
    a. Right-click RequireIntegrityActivationAuthenticationLevel, select Modify.
    b. To disable hardening changes, enter Value Data = 0 in hexadecimal format.
  1. After setting this registry key, restart the device to apply changes.

 

The possibility to disable the hardening changes depends on Microsoft timelines.
For more information about the timeline phases, see the Microsoft documentation: KB5004442—Manage changes for Windows DCOM Server Security Feature Bypass (CVE-2021-26414).

 

Enabling Hardening Changes

If hardening changes are not enabled by default, you can manually force those changes.
For more information, see the Microsoft documentation: KB5004442—Manage changes for Windows DCOM Server Security Feature Bypass (CVE-2021-26414).

 

1 – Modify the Registry Key

  1. In the Windows search box on the taskbar, enter REGEDIT to open Registry Editor.
  1. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat.
  1. Do one of the following:
  • If the value is already present, select RequireIntegrityActivationAuthenticationLevel.
  • If the value is not already present, create it (right-click AppCompat and select DWORD (32-bit) Value) and then select RequireIntegrityActivationAuthenticationLevel.
  1. To modify the registry key value data, do the following:
    a. Right-click RequireIntegrityActivationAuthenticationLevel, select Modify.
    b. To enable hardening changes, enter Value Data = 1 in hexadecimal format.
  1. After setting this registry key, restart the device to apply changes.

 

2 – Modify OPC DA Server DCOM Settings

  1. In the Windows search box on the taskbar, enter DCOMCNFG.
  • The DCOM configuration process is initiated.
  1. In the Component Services window, navigate to Console Root > Component Services > Computers > My Computer > DCOM Config.
  1. In the list of objects in the right window pane, right-click Siemens.OPC.Server.DA and select Properties.
  1. In the OPC DA Server Properties dialog box, select the General tab.
  1. From the Default Authentication Level drop-down list, select Packet Integrity.
  1. Click Apply.
  1. Click OK.

 

3 – Set Windows Security Options

To allow the WinCC OA Opc driver to connect to the remote OPCEnum, the following additional DCOM configuration must be performed on the remote machine:

  1. In the Windows search box on the taskbar, enter Control Panel.
  1. Select Administrative Tools.
  1. Select Local Security Policy.
  1. Navigate to Security Settings > Local Policies > Security Options.
  1. In the right pane, right-click Network access: Let Everyone permissions apply to anonymous users, and select Properties.
  1. Choose the Enabled option.
  1. Click Apply.
  1. Click OK.

 

4 – Handle Authentication Issues

If the following error occurs in the System logs (Event Viewer – Windows Logs – System):

Event ID 10038: "Application C:\Siemens\WinCC_OA\....\WCCOAopc.exe with PID %1 is requesting to activate CLSID %2 on computer %3 with default activation authentication level at %4. The lowest activation authentication level required by DCOM is 5(RPC_C_AUTHN_LEVEL_PKT_INTEGRITY). To raise the activation authentication level, please contact the application vendor."

(%1 – Application PID, %2 – CLSID of the COM class the application is requesting to activate, %3 – Computer Name, %4 – Value of Authentication Level)

You can do one of the following:

  1. In the Windows search box on the taskbar, enter DCOMCNFG.
  • The DCOM configuration process is initiated.
  1. In the Component Services window, navigate to Console Root > Component Services > Computers > My Computer.
  1. Right-click My Computer and select Properties.
  1. In the My Computer Properties dialog box, select the Default Properties tab.
  1. From the Default Authentication Level drop-down list, select Packet Integrity.
  1. Click Apply.
  1. Click OK.

 

NOTE: Please be aware that if you modify the machine wide DCOM settings, those changes will affect all the applications on the machine.