Sign in with
Sign up | Sign in
Your question

DCOM Server event

Tags:
  • Security
  • Microsoft
  • Servers
  • Windows
Last response: in Windows 2000/NT
Share
Anonymous
a b 8 Security
August 12, 2005 11:50:46 AM

Archived from groups: microsoft.public.win2000.security (More info?)

I have started noticing Event ID:10002 showing up on one of my servers when
it is rebooted. The description is as follows:

Access denied attempting to launch a DCOM Server. The server is:
{7E89FF0B-F649-4F9A-A9C3-F05DFAAA3DA1}
The user is SYSTEM/NT AUTHORITY, SID=S-1-5-18.

Has anyone else seen this and if so what is causing it?

Thank You,
Randy H

More about : dcom server event

Anonymous
a b 8 Security
August 12, 2005 6:00:03 PM

Archived from groups: microsoft.public.win2000.security (More info?)

Start with a search in the registry for the string
7E89FF0B-F649-4F9A-A9C3-F05DFAAA3DA1
so that you can id what component is involved.

--
Roger
"Randy Haley" <randy@etbu.edu> wrote in message
news:gZadnZ2dnZ0WXUH2nZ2dnbsGYd-dnZ2dRVn-0J2dnZ0@giganews.com...
> I have started noticing Event ID:10002 showing up on one of my servers
when
> it is rebooted. The description is as follows:
>
> Access denied attempting to launch a DCOM Server. The server is:
> {7E89FF0B-F649-4F9A-A9C3-F05DFAAA3DA1}
> The user is SYSTEM/NT AUTHORITY, SID=S-1-5-18.
>
> Has anyone else seen this and if so what is causing it?
>
> Thank You,
> Randy H
>
>
Anonymous
a b 8 Security
August 15, 2005 1:02:02 PM

Archived from groups: microsoft.public.win2000.security (More info?)

It seems to be coming from Microsoft SMS advanced agent:
C:\WINNT\system32\CCM\CcmExec.exe

Randy


"Roger Abell" <mvpNOSpam@asu.edu> wrote in message
news:o GopKD4nFHA.320@TK2MSFTNGP09.phx.gbl...
> Start with a search in the registry for the string
> 7E89FF0B-F649-4F9A-A9C3-F05DFAAA3DA1
> so that you can id what component is involved.
>
> --
> Roger
> "Randy Haley" <randy@etbu.edu> wrote in message
> news:gZadnZ2dnZ0WXUH2nZ2dnbsGYd-dnZ2dRVn-0J2dnZ0@giganews.com...
> > I have started noticing Event ID:10002 showing up on one of my servers
> when
> > it is rebooted. The description is as follows:
> >
> > Access denied attempting to launch a DCOM Server. The server is:
> > {7E89FF0B-F649-4F9A-A9C3-F05DFAAA3DA1}
> > The user is SYSTEM/NT AUTHORITY, SID=S-1-5-18.
> >
> > Has anyone else seen this and if so what is causing it?
> >
> > Thank You,
> > Randy H
> >
> >
>
>
August 23, 2005 2:40:45 PM

Archived from groups: microsoft.public.win2000.security (More info?)

Randy Haley wrote:
> I have started noticing Event ID:10002 showing up on one of my servers when
> it is rebooted. The description is as follows:
>
> Access denied attempting to launch a DCOM Server. The server is:
> {7E89FF0B-F649-4F9A-A9C3-F05DFAAA3DA1}
> The user is SYSTEM/NT AUTHORITY, SID=S-1-5-18.
>
> Has anyone else seen this and if so what is causing it?
>
> Thank You,
> Randy H
>
>
CAUSE
This issue occurs because the Microsoft Search (MSSearch) service starts
before the Web Storage System starts, and the Microsoft Search service
tries to automatically start the Web Storage System by using distributed
COM (DCOM). The Web Storage System is secured to prevent programs from
starting the Web Storage System with DCOM; therefore, an error is
recorded when the Microsoft Search service tries to do so.

http://support.microsoft.com/default.aspx?scid=kb;en-us;298095
!