Update KB5049981 Causes Event ID 7023 Error For Service Control Manager....System Guard Runtime Monitor Broker.exe terminated with Error %%3489660935

Anonymous
2025-01-14T23:56:45+00:00

Hello all. I am on Win10 Home Version 22H2  OS Build 19045.5371 on a HP Omen Desktop and a HP Envy Laptop. I noticed today upon checking my Event Viewer after installing patch Tuesday updates Cumulative Update for Windows 10 Version 22H2 for x64-based Systems KB5049981 and KB5050188 and also KB890830 I started seeing the below Event 7023 Service Control Manager....SgrmBroker.exe (System Guard Runtime Monitor Broker] Terminated with Error %%3489660935 after restarting my computer. I have run SFC and DISM and did not find any integrity violations. I am not seeing any other computer problems except this error. Tried to change the System Guard Runtime Monitor Broker Service but access is denied and remains on Delayed Start. I do not use Windows Defender but I use Norton 360 Select Plus on both computers. Is anyone else seeing this and is there a solution for this error. I have tried everything including the registry “HKEY_Local_MACHINE\SYSTEM\CurrentControlSet\Services” Start setting change from 3 to 4 but that causes a lot of Security SPP errors so I changed the value back and did a system restore that I had made before hand. It would appear the Update problem is with KB5049981. Microsoft this needs to be fixed as I feel the integrity of the Windows platform is at risk with this service not starting like it is suppose to do.

Respectfully,

Don

Log Name:      System

Source:        Service Control Manager

Date:          1/14/2025 3:48:16 PM

Event ID:      7023

Task Category: None

Level:         Error

Keywords:      Classic

User:          N/A

Computer:      DESKTOP-

Description:

The System Guard Runtime Monitor Broker service terminated with the following error:

%%3489660935

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />

    <EventID Qualifiers="49152">7023</EventID>

    <Version>0</Version>

    <Level>2</Level>

    <Task>0</Task>

    <Opcode>0</Opcode>

    <Keywords>0x8080000000000000</Keywords>

    <TimeCreated SystemTime="2025-01-14T20:48:16.2255419Z" />

    <EventRecordID>243885</EventRecordID>

    <Correlation />

    <Execution ProcessID="468" ThreadID="7164" />

    <Channel>System</Channel>

    <Computer>DESKTOP-             </Computer>

    <Security />

  </System>

  <EventData>

    <Data Name="param1">System Guard Runtime Monitor Broker</Data>

    <Data Name="param2">%%3489660935</Data>

    <Binary>5300670072006D00420072006F006B00650072000000</Binary>

  </EventData>

</Event>

Windows for home | Windows 10 | Performance and system failures

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
lmacri 2,505 Reputation points
2025-02-05T12:08:24+00:00

... It's definitely unsettling, as the System Guard Runtime Monitor is an important security feature, particularly if the hardware doesn't support Secure Launch. It has to be a bug. I hope that Microsoft will prioritize fixing this.

Hi Jay G4:

User 0xb1a’s 20-Jan-2025 post <here> in this topic includes the contents of Microsoft bulletin WI982633 stating that Microsoft is aware of this bug and has marked the status as "Mitigated". From that bulletin:

"This service was originally created for Microsoft Defender, but it has not been a part of its operation for a very long time*. Although Windows updates released January 14, 2025 conflict with the initialization of this service, no impact to performance or functionality should be observed.*

There is no change to the security level of a device resulting from this issue. This service has already been disabled in other supported versions of Windows, and SgrmBroker.exe presently serves no purpose*.*

Note: There is no need to manually start this service or configure it in any way (doing so might trigger errors unnecessarily). Future Windows updates will adjust the components used by this service and SgrmBroker.exe. For this reason, please do not attempt to manually uninstall or remove this service or its components."

The "Known Issues" section of the release notes for KB5049981 (OS Build 19045.5371, released 14-Jan-2025 ) at https://support.microsoft.com/help/5049981 states that "We are working on a resolution and will provide an update in an upcoming release" so I'm hoping the February 2025 Patch Tuesday updates scheduled for 11-Feb-2025 will include a bug fix that stops these System Guard Runtime Monitor Broker service (SgrmBroker.exe) Event ID 7023 errors.

Dell Inspiron 15 5584 * 64-bit Win 10 Pro v22H2 build 19045.5371 * Firefox v135.0.0 * Microsoft Defender v4.18.24090.11-1.1.24090.11 * Malwarebytes Premium v5.2.5.158-1.0.5135 * Macrium Reflect Free v8.0.7783

Was this answer helpful?

10+ people found this answer helpful.
0 comments

82 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2025-02-03T04:39:58+00:00

    It is strange to say the least. I only have a few programs on this machine Visual Studio 2020, VS Code, host an IIS website and Office used rarely, and that is about it. As far as i can tell the update to Visual Studio, or updating to the latest OS patches from windows update. Nothing else has changed and no BSOD for 5 year. Seems about 90% of the the time my system now will simply hang and i must hard power off. Sometimes i'm able to run from 3 minutes to about 12 hours currently before it just randomly freezes. Tried looking that the dump files i do see, they seem messed up and not really useful :(

    I was able to get into windows update and was able to get an update which seems targets .Net Framework 3.5, 4.8, after getting that on my box, surprise surprise the system stayed up a longer after that updates but, before that patch 15 or 20 minutes was max, but as mentioned seems i can run possibly 12 hours.

    Was this answer helpful?

    0 comments
  2. Anonymous
    2025-01-26T00:59:10+00:00

    Your blue screen is not related to this. It's just a coincidence. I would investigate your blue screen. Typically they are caused by out of date video drivers.

    Was this answer helpful?

    0 comments
  3. lmacri 2,505 Reputation points
    2025-01-25T21:39:00+00:00

    ... As for when the BSOD occur they will occur randomly now ... What is interesting checking the System Guard service properties, i see the service is pointing to the exe being in "system32" but it doesn't exist on the drive ...

    Hi ZooDoo4U:

    What is the version and build of your Win 10 OS [open a Run dialog box (Windows key + R) and enter winver]?

    From my search for "sgrm" in C:\Windows\System32 from File Explorer. It looks like my SgrmBroker.exe was last updated 17-Jan-2025, which is the same day Windows Update installed my KB5049981 monthly cumulative Quality Update (Win 10 v22H2 OS Build 19045.5371) along with my other January 2025 Patch Tuesday updates.

    Image

    I suspect your randomly-occurring BSODs have nothing to do with SgrmBroker.exe since my Event ID 7023 errors for the System Guard Runtime Monitor Broker service only occur when I boot up in the morning or restart Windows. I also don't recall anyone else confirming that these Event ID 7023 errors are causing BSODs, but I might be wrong about that.

    In a worst case scenario where an analysis of your full dump files with WinDbg confirms SgrmBroker.exe is responsible for your BSODs then 0xb1a's 20-Jan-2025 post <here> on page 4 of this topic includes instructions for disabling the System Guard Runtime Monitor Broker service. However, Microsoft has warned that "There is no need to manually start this service or configure it in any way (doing so might trigger errors unnecessarily). Future Windows updates will adjust the components used by this service and SgrmBroker.exe".

    Dell Inspiron 15 5584 * 64-bit Win 10 Pro v22H2 build 19045.5371 * Firefox v134.0.2 * Microsoft Defender v4.18.24090.11-1.1.24090.11 * Malwarebytes Premium v5.2.5.158-1.0.5135 * Macrium Reflect Free v8.0.7783

    Was this answer helpful?

    0 comments
  4. lmacri 2,505 Reputation points
    2025-01-25T19:32:59+00:00

    ... Just seems strange for years no problems at all, now it seem 100% of the times i see the error for the system guard... followed by a BSOD... :(

    Hi ZooDoo4U:

    Do your BSODs always occur at Windows startup? I only see these System Guard Runtime Monitor Broker service (SgrmBroker.exe) errors on my Win 10 machine when I boot up in the morning or restart Windows.

    My 14-Oct-2020 post in LawrenceJohnston's My Vista Machine Frequently Gets the Blue Screen of Death - Help includes instructions for using free utilities like Nirsoft's BlueScreenView and Resplendence's Who Crashed to interpret and summarize the Bug Check (BC) codes in Windows mini-dump files. These utilities only list basic details (filename, product name, file description, and file version) of the suspected driver / module that was loaded in the crash stack at the time of the crash so they aren't as accurate as a detailed Windows Debugger (WinDbg) analysis of your full dump files, but if SgrmBroker.exe is the cause of your BSODs it should be listed somewhere in the crash stack.

    If you post your full dump files in BleepingComputer's free Windows Crashes and Blue Screen of Death (BSOD) Help and Support board one of the trained volunteers will run an analysis with Windows Debugger (WinDbg) for you. Posting guidelines are pinned <here> at the top of that BleepingComputer board and explain what information you should include in your first post.

    Dell Inspiron 15 5584 * 64-bit Win 10 Pro v22H2 build 19045.5371 * Firefox v134.0.2 * Microsoft Defender v4.18.24090.11-1.1.24090.11 * Malwarebytes Premium v5.2.5.158-1.0.5135 * Macrium Reflect Free v8.0.7783

    Was this answer helpful?

    0 comments