DCOM Server event

[Randy Haley]

I have started noticing Event ID:10002 showing up on one of my servers when
it is rebooted. The description is as follows:

Access denied attempting to launch a DCOM Server. The server is:
{7E89FF0B-F649-4F9A-A9C3-F05DFAAA3DA1}
The user is SYSTEM/NT AUTHORITY, SID=S-1-5-18.

Has anyone else seen this and if so what is causing it?

Thank You,
Randy H

 

[Roger Abell]

Start with a search in the registry for the string
7E89FF0B-F649-4F9A-A9C3-F05DFAAA3DA1
so that you can id what component is involved.

 

[Randy Haley]

It seems to be coming from Microsoft SMS advanced agent:
C:\WINNT\system32\CCM\CcmExec.exe

Randy

 

[SpeeD]

I have started noticing Event ID:10002 showing up on one of my servers when
it is rebooted. The description is as follows:

Access denied attempting to launch a DCOM Server. The server is:
{7E89FF0B-F649-4F9A-A9C3-F05DFAAA3DA1}
The user is SYSTEM/NT AUTHORITY, SID=S-1-5-18.

Has anyone else seen this and if so what is causing it?

Thank You,
Randy H

CAUSE
This issue occurs because the Microsoft Search (MSSearch) service starts
before the Web Storage System starts, and the Microsoft Search service
tries to automatically start the Web Storage System by using distributed
COM (DCOM). The Web Storage System is secured to prevent programs from
starting the Web Storage System with DCOM; therefore, an error is
recorded when the Microsoft Search service tries to do so.

http://support.microsoft.com/default.aspx?scid=kb;en-us;298095