DCOM Error

[Eric]

I'm getting a DCOM error in the event log:

Event ID: 10002

Description:

Access denied attempting to launch a DCOM Server. The server is:
{00020906-0000-0000-C000-000000000046}
The user is Unavailable/Unavailable, SID=Unavailable.

I found this article relating to the error, but it didn't help:

http://support.microsoft.com/kb/290398

If I search for the server in the registry, it refers to MS Word.

We're running a Windows 2000 Terminal Server with Service Pack 4, and
Microsoft Word 2002.

What's generating this error and how can I fix it?

 

[Vera Noest [MVP]]

Check this for more info, although it doesn't offer a clear
solution:
http://www.eventid.net/display.asp?eventid=10002&eventno=310
&source=DCOM&phase=1

Since the EventID records an "access denied" error, I would
download FileMon and RegMon from http://www.sysinternals.com/. Run
them as administrator (when no user is connected), start a TS
session as a normal user and try to run the application.

FileMon and RegMon will show you all "access denied" errors that
occur, so that you can give your users the necessary permissions on
a file-to file or Registry subkey basis.

 

[TP]

Is this server behind a firewall?

-TP

 

[Eric]

I discovered the error coincides with opening Microsoft Word as the
Outlook e-mail editor.

Below is the results from regmon:

1 12:31:11 PM svchost.exe:540 OpenKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046} SUCCESS Access:
0x2000000
2 12:31:11 PM svchost.exe:540 OpenKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046}\TreatAs NOTFOUND
3 12:31:11 PM svchost.exe:540 CloseKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046} SUCCESS
4 12:31:11 PM svchost.exe:540 OpenKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046} SUCCESS Access:
0x2000000
5 12:31:11 PM svchost.exe:540 OpenKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046}\InprocServer32 NOTFOUND
6 12:31:11 PM svchost.exe:540 OpenKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046}\InprocServerX86 NOTFOUND
7 12:31:11 PM svchost.exe:540 OpenKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046}\LocalServer32 SUCCESS
Access: 0x2000000
8 12:31:11 PM svchost.exe:540 QueryValue
HKCR\CLSID\{00020906-0000-0000-C000-000000000046}\LocalServer32\LocalServer32
SUCCESS "C84DVn-}f(YR]eAR6.jiWORDFiles>L&rfUmW.cG.e%fI4G}jd"
9 12:31:11 PM svchost.exe:540 CloseKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046}\LocalServer32 SUCCESS
10 12:31:11 PM svchost.exe:540 OpenKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046}\InprocServer32 NOTFOUND
11 12:31:11 PM svchost.exe:540 OpenKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046}\InprocServerX86 NOTFOUND
12 12:31:11 PM svchost.exe:540 OpenKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046}\LocalServer32 SUCCESS
Access: 0x2000000
13 12:31:11 PM svchost.exe:540 QueryValue
HKCR\CLSID\{00020906-0000-0000-C000-000000000046}\LocalServer32\(Default)
SUCCESS "C:\PROGRA~1\MICROS~3\Office10\WINWORD.EXE"
14 12:31:11 PM svchost.exe:540 CloseKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046}\LocalServer32 SUCCESS
15 12:31:11 PM svchost.exe:540 CloseKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046} SUCCESS
16 12:31:11 PM svchost.exe:540 OpenKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046} SUCCESS Access:
0x2000000
17 12:31:11 PM svchost.exe:540 QueryValue
HKCR\CLSID\{00020906-0000-0000-C000-000000000046}\AppID SUCCESS
"{00020906-0000-0000-C000-000000000046}"
18 12:31:11 PM svchost.exe:540 CloseKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046} SUCCESS
19 12:31:11 PM svchost.exe:540 OpenKey
HKCR\AppID\{00020906-0000-0000-C000-000000000046} SUCCESS Access:
0x2000000
20 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\(Default) SUCCESS
"Microsoft Word Document"
21 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\LocalService NOTFOUND
22 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\DllSurrogate NOTFOUND
23 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\RunAs NOTFOUND
24 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\ActivateAtStorage
NOTFOUND
25 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\LaunchPermission
NOTFOUND
26 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\AccessPermission
NOTFOUND
27 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\AuthenticationLevel
NOTFOUND
28 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\RemoteServerName
NOTFOUND
29 12:31:11 PM svchost.exe:540 CloseKey
HKCR\AppID\{00020906-0000-0000-C000-000000000046} SUCCESS
30 12:31:11 PM svchost.exe:540 OpenKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046} SUCCESS Access:
0x2000000
31 12:31:11 PM svchost.exe:540 OpenKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046}\TreatAs NOTFOUND
32 12:31:11 PM svchost.exe:540 CloseKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046} SUCCESS
33 12:31:11 PM svchost.exe:540 OpenKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046} SUCCESS Access:
0x2000000
34 12:31:11 PM svchost.exe:540 OpenKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046}\InprocServer32 NOTFOUND
35 12:31:11 PM svchost.exe:540 OpenKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046}\InprocServerX86 NOTFOUND
36 12:31:11 PM svchost.exe:540 OpenKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046}\LocalServer32 SUCCESS
Access: 0x2000000
37 12:31:11 PM svchost.exe:540 QueryValue
HKCR\CLSID\{00020906-0000-0000-C000-000000000046}\LocalServer32\LocalServer32
SUCCESS "C84DVn-}f(YR]eAR6.jiWORDFiles>L&rfUmW.cG.e%fI4G}jd"
38 12:31:11 PM svchost.exe:540 CloseKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046}\LocalServer32 SUCCESS
39 12:31:11 PM svchost.exe:540 OpenKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046}\InprocServer32 NOTFOUND
40 12:31:11 PM svchost.exe:540 OpenKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046}\InprocServerX86 NOTFOUND
41 12:31:11 PM svchost.exe:540 OpenKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046}\LocalServer32 SUCCESS
Access: 0x2000000
42 12:31:11 PM svchost.exe:540 QueryValue
HKCR\CLSID\{00020906-0000-0000-C000-000000000046}\LocalServer32\(Default)
SUCCESS "C:\PROGRA~1\MICROS~3\Office10\WINWORD.EXE"
43 12:31:11 PM svchost.exe:540 CloseKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046}\LocalServer32 SUCCESS
44 12:31:11 PM svchost.exe:540 CloseKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046} SUCCESS
45 12:31:11 PM svchost.exe:540 OpenKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046} SUCCESS Access:
0x2000000
46 12:31:11 PM svchost.exe:540 QueryValue
HKCR\CLSID\{00020906-0000-0000-C000-000000000046}\AppID SUCCESS
"{00020906-0000-0000-C000-000000000046}"
47 12:31:11 PM svchost.exe:540 CloseKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046} SUCCESS
48 12:31:11 PM svchost.exe:540 OpenKey
HKCR\AppID\{00020906-0000-0000-C000-000000000046} SUCCESS Access:
0x2000000
49 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\(Default) SUCCESS
"Microsoft Word Document"
50 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\LocalService NOTFOUND
51 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\DllSurrogate NOTFOUND
52 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\RunAs NOTFOUND
53 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\ActivateAtStorage
NOTFOUND
54 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\LaunchPermission
NOTFOUND
55 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\AccessPermission
NOTFOUND
56 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\AuthenticationLevel
NOTFOUND
57 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\RemoteServerName
NOTFOUND
58 12:31:11 PM svchost.exe:540 CloseKey
HKCR\AppID\{00020906-0000-0000-C000-000000000046} SUCCESS
59 12:31:11 PM svchost.exe:540 OpenKey
HKCR\AppID\{00020906-0000-0000-C000-000000000046} SUCCESS Access:
0x2000000
60 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\(Default) SUCCESS
"Microsoft Word Document"
61 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\LocalService NOTFOUND
62 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\DllSurrogate NOTFOUND
63 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\RunAs NOTFOUND
64 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\ActivateAtStorage
NOTFOUND
65 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\LaunchPermission
NOTFOUND
66 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\AccessPermission
NOTFOUND
67 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\AuthenticationLevel
NOTFOUND
68 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\RemoteServerName
NOTFOUND
69 12:31:11 PM svchost.exe:540 CloseKey
HKCR\AppID\{00020906-0000-0000-C000-000000000046} SUCCESS
70 12:31:11 PM svchost.exe:540 OpenKey
HKCR\AppID\{00020906-0000-0000-C000-000000000046} SUCCESS Access:
0x2000000
71 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\DebugSurrogate NOTFOUND
72 12:31:11 PM svchost.exe:540 CloseKey
HKCR\AppID\{00020906-0000-0000-C000-000000000046} SUCCESS
73 12:31:11 PM svchost.exe:540 OpenKey
HKCR\AppID\{00020906-0000-0000-C000-000000000046} SUCCESS Access:
0x2000000
74 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\(Default) SUCCESS
"Microsoft Word Document"
75 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\LocalService NOTFOUND
76 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\DllSurrogate NOTFOUND
77 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\RunAs NOTFOUND
78 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\ActivateAtStorage
NOTFOUND
79 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\LaunchPermission
NOTFOUND
80 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\AccessPermission
NOTFOUND
81 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\AuthenticationLevel
NOTFOUND
82 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\RemoteServerName
NOTFOUND
83 12:31:11 PM svchost.exe:540 CloseKey
HKCR\AppID\{00020906-0000-0000-C000-000000000046} SUCCESS
84 12:31:11 PM svchost.exe:540 OpenKey
HKCR\AppID\{00020906-0000-0000-C000-000000000046} SUCCESS Access:
0x2000000
85 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\(Default) SUCCESS
"Microsoft Word Document"
86 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\LocalService NOTFOUND
87 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\DllSurrogate NOTFOUND
88 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\RunAs NOTFOUND
89 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\ActivateAtStorage
NOTFOUND
90 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\LaunchPermission
NOTFOUND
91 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\AccessPermission
NOTFOUND
92 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\AuthenticationLevel
NOTFOUND
93 12:31:11 PM svchost.exe:540 QueryValue
HKCR\AppID\{00020906-0000-0000-C000-000000000046}\RemoteServerName
NOTFOUND
94 12:31:11 PM svchost.exe:540 CloseKey
HKCR\AppID\{00020906-0000-0000-C000-000000000046} SUCCESS
95 12:31:11 PM svchost.exe:540 OpenKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046} SUCCESS Access: 0x20019
96 12:31:11 PM svchost.exe:540 OpenKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046}\LocalServer32 SUCCESS
Access: 0x2000000
97 12:31:11 PM svchost.exe:540 QueryValue
HKCR\CLSID\{00020906-0000-0000-C000-000000000046}\LocalServer32\ServerExecutable
NOTFOUND
98 12:31:11 PM svchost.exe:540 CloseKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046}\LocalServer32 SUCCESS
99 12:31:11 PM svchost.exe:540 CloseKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046} SUCCESS
100 12:31:11 PM svchost.exe:540 OpenKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046} SUCCESS Access:
0x2000000
101 12:31:11 PM svchost.exe:540 CloseKey
HKCR\CLSID\{00020906-0000-0000-C000-000000000046} SUCCESS

 

[Eric]

No, at least none I'm aware of.

Is this server behind a firewall?

-TP

 

[TP]

I see in your response to Vera that you determined
that the errors coincide with editing a message in
Outlook, but I will throw in my 2 cents just as an
FYI.

When I saw this in the past, it was caused by
machines on the Internet probing to see if the
machine had the DCOM vulernability. There are
ready made tools out there that allow script
kiddies the ability to punch in an ip range and it
will do the rest.

Besides using a firewall, you might want to consider
turning off DCOM if you don't use it. You can do
this in dcomcnfg-->Default Properties tab-->Uncheck
Enable Distributed COM on this computer.

On a related note, security for a DCOM component
is configured using dcomcnfg as well.

You might want to try removing and then reinstalling
Word if you think it is just an application problem.

People experiencing the same error as you:

http://www.iis-resources.com/modules/newbb/viewtopic.php?topic_id=1210&forum=3&post_id=5675

DCOM Vulnerability tester:

http://www.grc.com/dcom/

Thanks.

-TP

 

[Vera Noest [MVP]]

In addition to TP's advice:
It is *not* recommended to use Word as the default editor in
Outlook on a TS. This is known to cause performance problems (Word
"hangs", Word doesn't close when you close Outlook, preventing the
session from ending, etc.)

Documented here:

Deploying Office XP on Windows Terminal Services
http://office.microsoft.com/en-gb/assistance/HA011363351033.aspx