Update KB5049981 Causes Event ID 7023 Error For Service Control Manager....System Guard Runtime Monitor Broker.exe terminated with Error %%3489660935

Microsoft informed some customers:

Event Viewer displays an error for System Guard Runtime Monitor Broker service

Status: Mitigated

Affected platforms:

OS Versions	Message ID	Originating KB	Resolved KB
Windows 10, version 22H2	WI982633	KB5049981	-
Windows Server 2022	WI982632	KB5049983	-

The Windows Event Viewer might display an error related to SgrmBroker.exe, on devices which have installed Windows updates released January 14, 2025 (the Originating KBs listed above) or later.

This error can be found underWindows Logs > System as Event 7023, with text similar to 'The System Guard Runtime Monitor Broker service terminated with the following error: %%3489660935'.

This error is only observable if the Windows Event Viewer is monitored closely. It is otherwise silent and does not appear as a dialog box or notification.

SgrmBroker.exe refers to the System Guard Runtime Monitor Broker Service.
This service was originally created for Microsoft Defender, but it has not been a part of its operation for a very long time.
Although Windows updates released January 14, 2025 conflict with the initialization of this service, no impact to performance or functionality should be observed.
There is no change to the security level of a device resulting from this issue.
This service has already been disabled in other supported versions of Windows, and SgrmBroker.exe presently serves no purpose.

Note: There is no need to manually start this service or configure it in any way (doing so might trigger errors unnecessarily).
Future Windows updates will adjust the components used by this service and SgrmBroker.exe.
For this reason,please do not attempt to manually uninstall or remove this service or its components.

Workaround:

No specific action is required, however, the service can be safely disabled in order to prevent the error from appearing in Event Viewer.
To do so, you can follow these steps:

1) Open a Command Prompt window. This can be accomplished by opening the Start menu and typing 'cmd'.
The results will include "Command Prompt" as a System application. Select the arrow to the right of "Command Prompt" and select "Run as administrator".

2) Once the window is open, carefully enter the following text:

    sc.exe config sgrmagent start=disabled

3) A message may appear afterwards. Next, enter the following text:

    reg add HKLM\System\CurrentControlSet\Services\SgrmBroker /v Start /d 4 /t REG_DWORD

4) Close the Command Prompt window. This will prevent the related error from appearing in the Event Viewer on subsequent device start up.

Note that some of these steps might be restricted by group policy set by your organization.

Next steps: We are working on a resolution and will provide an update in an upcoming release.

Uhmm, WOW! Allow me to parse this response and extract something that may not be as obvious as it very much NEEDS to be.

**SgrmBroker.exe refers to the System Guard Runtime Monitor Broker Service.**This service was originally created for Microsoft Defender, but it has not been a part of its operation for a very long time.
Although Windows updates released January 14, 2025 conflict with the initialization of this service, no impact to performance or functionality should be observed.

1. Why oh why would the initialization of stated "dead code" be changed as part of this update?
2. More importantly, why would that not be noticed during pre-release code review? (I'm assuming here that that still happens.)
3. Why would the error not be flagged during system verification testing?
4. Summing all this up, why does the update development and verification system appear, to its user base, to have fallen flat on its face? This question is not peculiar to just this update but speaks to the significant increase in incompatibility bugs and issues that have become the new norm in both Win 10 and Win 11 of all flavors?

Your systems aren't vulnerable.

I have never seen a Windows event log that is error free. Ever.

Based on my experience in patching this appears to be one of those errors that doesn't cause any impact to the system and in a month or so will go away when they finally fix it in a future patch. In the meantime the best way to bring this to Microsoft's attention is to file a Windows feedback item.

Thank you for your reply but if you had read the earlier comments you would know that bug reports have already been filed in the Feedback Hub with comments and upvotes to go along with them. Just to let you know that my Event Logs rarely contains an "error" up until now or with past flawed MS updates. I see in my System Log are the four DistribitedCOM warnings which are well known to happen and can be ignored according to MS on Start-Up or an occasional WLAN-AutoConfig warning which is nothing. I am wondering if you are really with Customer Support as your user name implies since you just joined the Forum today as I have never seen anyone from MS Customer Support comment in this Forum.

Respectfully,

Seems odd, searching around seems the sgmbroker.exe command has been removed and is not really used any longer. Found this article:

https://www.techzine.eu/news/security/128100/microsoft-reassures-users-bug-in-windows-10-patch-is-not-a-problem/

Which mentions Microsoft acknowledges the error and a fix is suppose to be coming. Strange my system has been solid for three years not one hiccup. But Checking the event log when seeing this error it is just before a bluescreen event. And from what i can see the two started happening at the same time. Just seems strange for years no problems at all, now it seem 100% of the times i see the error for the system guard... followed by a BSOD... :(

Fair enough... So, I can confirm that I saw this error on a Windows Server 2022 Datacenter Azure Edition running as Domain Controller.