DCOM Server event

  • Thread starter Thread starter Randy Haley
  • Start date Start date
R

Randy Haley

I have started noticing Event ID:10002 showing up on one of my servers when
it is rebooted. The description is as follows:

Access denied attempting to launch a DCOM Server. The server is:
{7E89FF0B-F649-4F9A-A9C3-F05DFAAA3DA1}
The user is SYSTEM/NT AUTHORITY, SID=S-1-5-18.

Has anyone else seen this and if so what is causing it?

Thank You,
Randy H
 
Start with a search in the registry for the string
7E89FF0B-F649-4F9A-A9C3-F05DFAAA3DA1
so that you can id what component is involved.
 
It seems to be coming from Microsoft SMS advanced agent:
C:\WINNT\system32\CCM\CcmExec.exe

Randy
 
Randy said:
I have started noticing Event ID:10002 showing up on one of my servers when
it is rebooted. The description is as follows:

Access denied attempting to launch a DCOM Server. The server is:
{7E89FF0B-F649-4F9A-A9C3-F05DFAAA3DA1}
The user is SYSTEM/NT AUTHORITY, SID=S-1-5-18.

Has anyone else seen this and if so what is causing it?

Thank You,
Randy H
Click to expand...
CAUSE
This issue occurs because the Microsoft Search (MSSearch) service starts
before the Web Storage System starts, and the Microsoft Search service
tries to automatically start the Web Storage System by using distributed
COM (DCOM). The Web Storage System is secured to prevent programs from
starting the Web Storage System with DCOM; therefore, an error is
recorded when the Microsoft Search service tries to do so.

http://support.microsoft.com/default.aspx?scid=kb;en-us;298095
 
Back
Top