Update KB5049981 Causes Event ID 7023 Error For Service Control Manager....System Guard Runtime Monitor Broker.exe terminated with Error %%3489660935

Anonymous
2025-01-14T23:56:45+00:00

Hello all. I am on Win10 Home Version 22H2  OS Build 19045.5371 on a HP Omen Desktop and a HP Envy Laptop. I noticed today upon checking my Event Viewer after installing patch Tuesday updates Cumulative Update for Windows 10 Version 22H2 for x64-based Systems KB5049981 and KB5050188 and also KB890830 I started seeing the below Event 7023 Service Control Manager....SgrmBroker.exe (System Guard Runtime Monitor Broker] Terminated with Error %%3489660935 after restarting my computer. I have run SFC and DISM and did not find any integrity violations. I am not seeing any other computer problems except this error. Tried to change the System Guard Runtime Monitor Broker Service but access is denied and remains on Delayed Start. I do not use Windows Defender but I use Norton 360 Select Plus on both computers. Is anyone else seeing this and is there a solution for this error. I have tried everything including the registry “HKEY_Local_MACHINE\SYSTEM\CurrentControlSet\Services” Start setting change from 3 to 4 but that causes a lot of Security SPP errors so I changed the value back and did a system restore that I had made before hand. It would appear the Update problem is with KB5049981. Microsoft this needs to be fixed as I feel the integrity of the Windows platform is at risk with this service not starting like it is suppose to do.

Respectfully,

Don

Log Name:      System

Source:        Service Control Manager

Date:          1/14/2025 3:48:16 PM

Event ID:      7023

Task Category: None

Level:         Error

Keywords:      Classic

User:          N/A

Computer:      DESKTOP-

Description:

The System Guard Runtime Monitor Broker service terminated with the following error:

%%3489660935

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />

    <EventID Qualifiers="49152">7023</EventID>

    <Version>0</Version>

    <Level>2</Level>

    <Task>0</Task>

    <Opcode>0</Opcode>

    <Keywords>0x8080000000000000</Keywords>

    <TimeCreated SystemTime="2025-01-14T20:48:16.2255419Z" />

    <EventRecordID>243885</EventRecordID>

    <Correlation />

    <Execution ProcessID="468" ThreadID="7164" />

    <Channel>System</Channel>

    <Computer>DESKTOP-             </Computer>

    <Security />

  </System>

  <EventData>

    <Data Name="param1">System Guard Runtime Monitor Broker</Data>

    <Data Name="param2">%%3489660935</Data>

    <Binary>5300670072006D00420072006F006B00650072000000</Binary>

  </EventData>

</Event>

Windows for home | Windows 10 | Performance and system failures

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
lmacri 2,505 Reputation points
2025-02-05T12:08:24+00:00

... It's definitely unsettling, as the System Guard Runtime Monitor is an important security feature, particularly if the hardware doesn't support Secure Launch. It has to be a bug. I hope that Microsoft will prioritize fixing this.

Hi Jay G4:

User 0xb1a’s 20-Jan-2025 post <here> in this topic includes the contents of Microsoft bulletin WI982633 stating that Microsoft is aware of this bug and has marked the status as "Mitigated". From that bulletin:

"This service was originally created for Microsoft Defender, but it has not been a part of its operation for a very long time*. Although Windows updates released January 14, 2025 conflict with the initialization of this service, no impact to performance or functionality should be observed.*

There is no change to the security level of a device resulting from this issue. This service has already been disabled in other supported versions of Windows, and SgrmBroker.exe presently serves no purpose*.*

Note: There is no need to manually start this service or configure it in any way (doing so might trigger errors unnecessarily). Future Windows updates will adjust the components used by this service and SgrmBroker.exe. For this reason, please do not attempt to manually uninstall or remove this service or its components."

The "Known Issues" section of the release notes for KB5049981 (OS Build 19045.5371, released 14-Jan-2025 ) at https://support.microsoft.com/help/5049981 states that "We are working on a resolution and will provide an update in an upcoming release" so I'm hoping the February 2025 Patch Tuesday updates scheduled for 11-Feb-2025 will include a bug fix that stops these System Guard Runtime Monitor Broker service (SgrmBroker.exe) Event ID 7023 errors.

Dell Inspiron 15 5584 * 64-bit Win 10 Pro v22H2 build 19045.5371 * Firefox v135.0.0 * Microsoft Defender v4.18.24090.11-1.1.24090.11 * Malwarebytes Premium v5.2.5.158-1.0.5135 * Macrium Reflect Free v8.0.7783

Was this answer helpful?

10+ people found this answer helpful.
0 comments

82 additional answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Anonymous
    2025-01-15T16:27:58+00:00

    It turns out that we are all being held for fools, the event log is needed to work on errors, that Windows, Nvidia's hundred with their updates break the entire system! why is this error happening? Is it safe to work in the system? After all, is this service responsible for security, or is it just another idea to switch everyone to the new windows 11? By force

    Was this answer helpful?

    10+ people found this answer helpful.
    0 comments
  2. Anonymous
    2025-01-15T17:04:40+00:00

    In Server Forum following andere from MS

    Lei Tao has replied to your question Server 2022 Windows Updates January 2025 System Guard Runtime Monitor Broker Service in Microsoft Support Community.
    Hello Mittelboeck Johannes,<br><br><br><br>thank you for posting on the Microsoft Community Forums. <br><br><br><br>Here are some steps you can take to troubleshoot and potentially resolve this issue: <br><br><br><br>1. Check Permissions: Make sure you have the necessary permissions to start the service. You might need administrative privileges to start it. <br><br><br><br>2. Run Services as Administrator:<br><br>- Open the Services management console as an administrator: <br><br>- Press Win + R, type services.msc, and press Ctrl + Shift + Enter to run it as an administrator. <br><br><br><br>3. Check for Updates: Make sure all Windows updates have been successfully installed. Sometimes, additional updates are released to fix issues introduced by previous updates. <br><br><br><br>4. Check Service Dependencies: Ensure all dependent services are running. In the properties of "System Guard Runtime Monitor Broker," look under the Dependencies tab to see which services it depends on and verify that they are running. <br><br><br><br>5. Run System File Checker: <br><br>- There might be corrupted system files causing this issue. You can run the System File Checker tool to scan and repair them. <br><br>- Open Command Prompt as an administrator and run:<br><br><br><br><br> sfc /scannow<br><br><br><br><br>6. Check Group Policy Settings:<br><br>- Ensure that there are no group policies that are preventing the service from starting. <br><br>- Open the Group Policy Editor (gpedit.msc) and navigate to Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment. <br><br><br><br>7. Reset Permissions:<br><br>- Open Command Prompt as an administrator and execute the following commands to reset permissions: <br><br><br><br><br> icacls C:\Windows\System32\SGMBroker.exe /grant administrators:F<br><br><br><br><br>Hope it helps.<br><br><br><br>Kind regards,<br><br>Lei

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments
  3. Anonymous
    2025-01-15T17:46:49+00:00

    Hello,

    Thanks for reaching out here in the Microsoft Answers Community.

    Since you have mentioned that you are "not seeing any other computer problems except this error", you can ignore the error.

    Usually, you can ignore the errors and warnings in system event logs. Most system services are designed for a wide range of system configurations and hardware, so such errors are expected.

    Also, based on the registry changes you have mentioned, you have disabled the Time Broker service, which is used for time-sensitive operations like notifications, alarms, and schedulers. Generally you should not disable system services, so please revert the registry edit.

    Thanks for your patience and understanding.

    Best Regards,

    Sheng G. - MSFT | Microsoft Community Support Specialist

    Thank you for your response and before I made any changes to the registry I made a restore point on my computer. When I saw the change that I made was of no help I changed the value back to its original and I ran a system restore which completely restored my files and registry. Now you stated "Since you have mentioned that you are "not seeing any other computer problems except this error", you can ignore the error. Usually, you can ignore the errors and warnings in system event logs. Most system services are designed for a wide range of system configurations and hardware, so such errors are expected." I find your statement very troubling coming from a M.S. Moderator that we should ignore the errors and warnings in system event logs. Now I do not know what your Event Log looks like but mine is clean of errors except for this one that should not be there. If we are to ignore warnings and errors then what is the purpose of the Event Log. I will not nor will I ever ignore any unexpected warnings and especially unexpected errors in my event log and I will investigate any that I see.

    Now from what you are saying is that a System Guard Runtime Monitor Broker.exe error should be ignored when in fact it is a very important system file according to this

    https://learn.microsoft.com/en-us/windows/security/hardware-security/how-hardware-based-root-of-trust-helps-protect-windows 

    which protects system integrity at startup, maintains system integrity through the runtime and validates system integrity maintenance via local and remote indicators. Whether myself or any other user experiencing this error are not seeing other computer problems does not mean that problems could not arise from this in the future. I and apparently other users consider this a problem since it would seem that our system integrity is at stake with this error and I feel this should be sent up higher to the powers that be like Devs or another Moderator familiar with this important Microsoft service to be looked at. This was clearly caused by the Jan. patch Tuesday updates. This is a Microsoft problem and Microsoft should either fix this error or put out some kind of statement about it whether our system integrity is at risk.

    Respectfully,

    Don

    Was this answer helpful?

    30+ people found this answer helpful.
    0 comments
  4. Anonymous
    2025-01-15T18:03:07+00:00

    Hello again everyone. I want to caution everyone having this error that has replied to my post to be cautious at trying any suggested fixes or any work around to try and solve this error as these may cause other problems down the road since this a system file designed to main Windows integrity at startup and during runtime. This problem is and was caused by a Microsoft update and they should be the ones to solve this the correct way. I would suggest that everyone having this error should go to the FeedBack Hub and file a bug report there. The more bug reports filed the quicker we can get this solved or hear from Microsoft. I have filed a bug report and the link is

    https://aka.ms/AAtyprv .

    Thank you everyone who replied and made your voice heard about this error. If I hear of anything from Microsoft I will let you know.

    Respectfully,

    Don

    Was this answer helpful?

    10+ people found this answer helpful.
    0 comments