Hi all
It seems Microsoft has now tightened their DCOM security in this months security updates:
https://support.microsoft.com/en-us/topic/kb5004442-manage-changes-for-windows-dcom-server-security-feature-bypass-cve-2021-26414-f1400b52-c141-43d2-941e-37ed901c769c
Since then, it seems that an FMC with AD integration causes every ~10 seconds a new log entry on the Domain Controller in regards to a DCOM error 10036. I found the following bug, but so far no solution:
https://bst.cisco.com/bugsearch/bug/CSCwb28103
Have you also noticed this in your environment?
I'm not yet sure if the Sourcefire AD Agent is installed here: https://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118131-technote-sourcefire-00.html or if it it also caused if only LDAP is configured (I doubt it).
The FMC is running 7.0.5, as are the firewalls.
