Update KB5049981 Causes Event ID 7023 Error For Service Control Manager....System Guard Runtime Monitor Broker.exe terminated with Error %%3489660935

Anonymous
2025-01-14T23:56:45+00:00

Hello all. I am on Win10 Home Version 22H2  OS Build 19045.5371 on a HP Omen Desktop and a HP Envy Laptop. I noticed today upon checking my Event Viewer after installing patch Tuesday updates Cumulative Update for Windows 10 Version 22H2 for x64-based Systems KB5049981 and KB5050188 and also KB890830 I started seeing the below Event 7023 Service Control Manager....SgrmBroker.exe (System Guard Runtime Monitor Broker] Terminated with Error %%3489660935 after restarting my computer. I have run SFC and DISM and did not find any integrity violations. I am not seeing any other computer problems except this error. Tried to change the System Guard Runtime Monitor Broker Service but access is denied and remains on Delayed Start. I do not use Windows Defender but I use Norton 360 Select Plus on both computers. Is anyone else seeing this and is there a solution for this error. I have tried everything including the registry “HKEY_Local_MACHINE\SYSTEM\CurrentControlSet\Services” Start setting change from 3 to 4 but that causes a lot of Security SPP errors so I changed the value back and did a system restore that I had made before hand. It would appear the Update problem is with KB5049981. Microsoft this needs to be fixed as I feel the integrity of the Windows platform is at risk with this service not starting like it is suppose to do.

Respectfully,

Don

Log Name:      System

Source:        Service Control Manager

Date:          1/14/2025 3:48:16 PM

Event ID:      7023

Task Category: None

Level:         Error

Keywords:      Classic

User:          N/A

Computer:      DESKTOP-

Description:

The System Guard Runtime Monitor Broker service terminated with the following error:

%%3489660935

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />

    <EventID Qualifiers="49152">7023</EventID>

    <Version>0</Version>

    <Level>2</Level>

    <Task>0</Task>

    <Opcode>0</Opcode>

    <Keywords>0x8080000000000000</Keywords>

    <TimeCreated SystemTime="2025-01-14T20:48:16.2255419Z" />

    <EventRecordID>243885</EventRecordID>

    <Correlation />

    <Execution ProcessID="468" ThreadID="7164" />

    <Channel>System</Channel>

    <Computer>DESKTOP-             </Computer>

    <Security />

  </System>

  <EventData>

    <Data Name="param1">System Guard Runtime Monitor Broker</Data>

    <Data Name="param2">%%3489660935</Data>

    <Binary>5300670072006D00420072006F006B00650072000000</Binary>

  </EventData>

</Event>

Windows for home | Windows 10 | Performance and system failures

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
lmacri 2,505 Reputation points
2025-02-05T12:08:24+00:00

... It's definitely unsettling, as the System Guard Runtime Monitor is an important security feature, particularly if the hardware doesn't support Secure Launch. It has to be a bug. I hope that Microsoft will prioritize fixing this.

Hi Jay G4:

User 0xb1a’s 20-Jan-2025 post <here> in this topic includes the contents of Microsoft bulletin WI982633 stating that Microsoft is aware of this bug and has marked the status as "Mitigated". From that bulletin:

"This service was originally created for Microsoft Defender, but it has not been a part of its operation for a very long time*. Although Windows updates released January 14, 2025 conflict with the initialization of this service, no impact to performance or functionality should be observed.*

There is no change to the security level of a device resulting from this issue. This service has already been disabled in other supported versions of Windows, and SgrmBroker.exe presently serves no purpose*.*

Note: There is no need to manually start this service or configure it in any way (doing so might trigger errors unnecessarily). Future Windows updates will adjust the components used by this service and SgrmBroker.exe. For this reason, please do not attempt to manually uninstall or remove this service or its components."

The "Known Issues" section of the release notes for KB5049981 (OS Build 19045.5371, released 14-Jan-2025 ) at https://support.microsoft.com/help/5049981 states that "We are working on a resolution and will provide an update in an upcoming release" so I'm hoping the February 2025 Patch Tuesday updates scheduled for 11-Feb-2025 will include a bug fix that stops these System Guard Runtime Monitor Broker service (SgrmBroker.exe) Event ID 7023 errors.

Dell Inspiron 15 5584 * 64-bit Win 10 Pro v22H2 build 19045.5371 * Firefox v135.0.0 * Microsoft Defender v4.18.24090.11-1.1.24090.11 * Malwarebytes Premium v5.2.5.158-1.0.5135 * Macrium Reflect Free v8.0.7783

Was this answer helpful?

10+ people found this answer helpful.
0 comments

82 additional answers

Sort by: Newest
Most helpful Newest Oldest
  1. Anonymous
    2025-01-18T18:59:14+00:00

    Hello DonT5, thank you for your feedback.

     

    This is an open community, so no one can acknowledge any issues on behalf of Microsoft.

     

    However, I have seen your submitted report and upvoted it. I have shared this report with other users, and I encourage you to continue sharing this report link with others (since you are also concerned about this issue, you can share this link in feedback posts of any users you see mentioning this problem).

    Image 

    I hope your issue gets resolved soon.

     

    Lugoo Bei | Microsoft Community Support Specialist   

    Thank you for your response. You stated "I have shared this report with other users, and I encourage you to continue sharing this report link 

    with others (since you are also concerned about this issue, you can share this link in feedback posts of any users you see mentioning this problem)". Now when you say other users do you mean this problem has been shared with those of higher authority like the Developers etc. etc. which I feel should be. I realize this is an open community as I have been here a few years which is a great place for other users to get help about any problems with their computers they may need or to make known about any problems that is seen that could or is effecting their computers after a MS update is installed. I do want to point out to you that I am not the only one concerned about this problem as you can see by the other posts. I and others feel this System Guard Runtime Monitor Broker.exe error is a serious error as it is a very important system file according to this

    https://learn.microsoft.com/en-us/windows/security/hardware-security/how-hardware-based-root-of-trust-helps-protect-windows 

    which protects system integrity at startup, maintains system integrity through the runtime and validates system integrity maintenance via local and remote indicators and this error concerns us whether our computers system integrity is at risk.

    Thank you for the upvote and the sharing of this error problem and yes I will continue sharing my post with others who are having trouble with this flawed update.

    Respectfully,

    Was this answer helpful?

    4 people found this answer helpful.
    0 comments
  2. Anonymous
    2025-01-18T03:30:36+00:00

    Hello DonT5, thank you for your feedback.

    This is an open community, so no one can acknowledge any issues on behalf of Microsoft.

    However, I have seen your submitted report and upvoted it. I have shared this report with other users, and I encourage you to continue sharing this report link with others (since you are also concerned about this issue, you can share this link in feedback posts of any users you see mentioning this problem).

     

    I hope your issue gets resolved soon.

    Lugoo Bei | Microsoft Community Support Specialist

    Was this answer helpful?

    3 people found this answer helpful.
    0 comments
  3. Anonymous
    2025-01-17T22:28:19+00:00

    Would a Moderator please read this post and the replies and acknowledge there is a problem with Update KB5049981 for Win10 computers and KB5049983 for servers and send it up the ladder to the Devs. I am also seeing other problems that are now being posted in the forum concerning this flawed update as well. I have filed a bug report about this and the link is https://aka.ms/AAtyprv .

    Respectfully,

    Was this answer helpful?

    4 people found this answer helpful.
    0 comments
  4. Anonymous
    2025-01-17T19:13:51+00:00

    Same problem here (W10 pro 22H2) on a HP Omen 30L, but fixed it with this workaround.

    These 4 files in the Windows\Sytem32 folder were updated on the 14th of januari

    • SgrmBroker.exe
    • SgrmEnclave.dll
    • SgrmEnclave_secure.dll
    • SgrmLpac.exe

    Renamed them and replaced them with an older backup (just before the 14th), and all is well now.

    Had to take the system offline to perform this action, because Windows would not let me do so on the fly.

    All should be well until you run SFC.

    Thanks for the info and possible solution which looks feasible to do but I feel that MS caused this problem with their buggy update KB5049981 for Win10 and KB5049983 for servers and it should be their responsibility to fix this and not ours. I just wish one time they would put out an update that will not screw something up on computers that run Win10 Home or Win10 Pro. It has gotten to the point that I dread when Patch Tuesday comes around each month. I am just going to wait for a fix from them. Thank you again for your findings.

    Respectfully,

    Was this answer helpful?

    10 people found this answer helpful.
    0 comments