diff -urN samba-4.10.16.old/source3/rpc_server/netlogon/srv_netlog_nt.c samba-4.10.16/source3/rpc_server/netlogon/srv_netlog_nt.c
--- samba-4.10.16.old/source3/rpc_server/netlogon/srv_netlog_nt.c	2023-07-16 10:18:26.101390835 +0300
+++ samba-4.10.16/source3/rpc_server/netlogon/srv_netlog_nt.c	2023-07-16 10:35:36.843060123 +0300
@@ -2672,6 +2672,11 @@
 	struct netlogon_creds_CredentialState *creds;
 	NTSTATUS status;
 
+	if (r->in.query_level != 1) {
+		p->fault_state = DCERPC_NCA_S_FAULT_INVALID_TAG;
+		return NT_STATUS_NOT_SUPPORTED;
+	}
+
 	become_root();
 	status = netr_creds_server_step_check(p, p->mem_ctx,
 					      r->in.computer_name,
@@ -2683,10 +2688,6 @@
 		return status;
 	}
 
-	if (r->in.query_level != 1) {
-		return NT_STATUS_NOT_SUPPORTED;
-	}
-
 	r->out.capabilities->server_capabilities = creds->negotiate_flags;
 
 	return NT_STATUS_OK;
diff -urN samba-4.10.16.old/source4/rpc_server/netlogon/dcerpc_netlogon.c samba-4.10.16/source4/rpc_server/netlogon/dcerpc_netlogon.c
--- samba-4.10.16.old/source4/rpc_server/netlogon/dcerpc_netlogon.c	2023-07-16 10:18:26.545400571 +0300
+++ samba-4.10.16/source4/rpc_server/netlogon/dcerpc_netlogon.c	2023-07-16 10:40:11.763109454 +0300
@@ -2910,6 +2910,10 @@
 	struct netlogon_creds_CredentialState *creds;
 	NTSTATUS status;
 
+	if (r->in.query_level != 1) {
+		DCESRV_FAULT(DCERPC_NCA_S_FAULT_INVALID_TAG);
+	}
+
 	status = dcesrv_netr_creds_server_step_check(dce_call,
 						     mem_ctx,
 						     r->in.computer_name,
@@ -2921,10 +2925,6 @@
 	}
 	NT_STATUS_NOT_OK_RETURN(status);
 
-	if (r->in.query_level != 1) {
-		return NT_STATUS_NOT_SUPPORTED;
-	}
-
 	r->out.capabilities->server_capabilities = creds->negotiate_flags;
 
 	return NT_STATUS_OK;