Event ID 4100 & Generation of New User Folder in Documents and Settings

[Sean]

Hi

Got a weird thing going on in my network.

Every Monday morning a random selection from my Windows 2000 Machines will
have the following error in the Application Log.

Source: EventSystem
Category: Firing Agent
Event ID: 4100
Description: The COM+ Event System failed to create an instance of the
subscriber {ID} CoCreateInstanceEX returned HResult 8000401A

When this happens a NEW user folder based on the default user is created for
the person using the computer. Sometimes this happens more than once at
start-up, so in Document's and Setting's we have;

User folder
User folder.domain
User folder.domain.000
User folder.domain.n

These new folders creation timestamps coincide with the timestamps in the
eventlog for the 4100 Event.

This is taking up valuable time every Monday and REALLY getting on my
nerves, historically the company dealt with this by remapping the folder
link in the profilelist registry key.

But this obviously has never fixed the issue.

Any help much appreciated.

 

[John John]

Fisrt hit on an Internet search for "Event ID 4100".

Event ID 4100 appears repeatedly in Event Viewer
http://support.microsoft.com/?kbid=289650

Second hit:
http://www.eventid.net/display.asp?eventid=4100&eventno=732&source=EventSystem&phase=1

John

 

[Sean]

Thanks for that John,

I'm an event ID Subscriber and none of the information on there relates to
the issue I am having.

I'm wondering if the Event is a bit of a red herring. Weird that it only
happens on 2K machines as well. And only on a Monday.

???

 

[Edwin vMierlo]

Sean,

in regards to the error code, this is from the winerror.h file

C:\>err 8000401A
# for hex 0x8000401a / decimal -2147467238
CO_E_RUNAS_LOGON_FAILURE winerror.h
# The server process could not be started because the
# configured identity is incorrect. Check the username and
# password.
# 1 matches found for "8000401A"

is this "Firing Agent" using a "run as" method ?
are all the dependant services started for this "Firing Agent" ?
ensure that this "Firing Agent" is properly configured in regards to
Accounts/Identity/Logon

HTH,
_Edwin.

 

[Sean]

Thanks for that Edwin,

I can't think of anything that needs to run as a specific user, thing is I
don't know what the firing agent is trying to do on startup.

On eventid.net it states the following about error code 0x8000401A in
conjunction with COM;

A process needed in order to perform an operation failed to start probably
due to an issue with the user account that is configured as the identity for
COM+ applications in the application that experiences the problem.

This problem may arise if the account used is out-of-sync. For example
Q255770, Q269001, and Q822699, troubleshoot situations in which the
IWAM_machine account in not in synch with the metabase, the Security Account
Manager (SAM), and COM+.

In Q289650, the problem is fixed by reregistering the Mobsync.dll file from
the server.

The Qn's all relate to IIS or other technololgies not in use in our network,
so no help there. There are no other Event's in any of the other logs that
coincide or may shed some light on this.

I'm wondering if the previous delvings into the registry by one of my
predecessors has caused this by breaking a relationship between UID's and
SID's in the registry, the only thing I do know for certain is that it has
never happened on any of our XP Machines, only the 2000 ones.

Cheers

http://www.eventid.net/errorsdisplay.asp?error_code=8000401A

 

[Edwin vMierlo]

Sean,

pardon my ignorance ... what is "Firing Agent" anyway ?
and have you checked the "Identity" settings in your COM+ ?
and / or can you re-install this app / com+ ?

 

[Sean]

Edwin no need to feel ignorant, because I don't know what it is either.



I thought it was a part of the system. I did a search for "firing agent" on
google but didn't get much back in the way of leads. There's a Microsoft KB
Article that mentions it but its more to do with systems management server
(which we don't have).

Still doesn't say what it is or what it does though.

Re checking identity settings in COM+, how do I do this? I take it through
the Component Services Snap-in for MMC but I don;t have a lot of experience
using this.

Cheers

Sean

 

[Edwin vMierlo]

Sean,

I presume that you mean http://support.microsoft.com/kb/831648

do you have those symptoms, e.g. do you also get the Event ID 4356 ?

If you do, please contact Microsoft Support to get the patch
(they will email this to you without cost)

rgds,
Edwin.

 

[Edwin vMierlo]

Sean,
sorry for the second posting, but I found another article just dealing with
Event 4100
have a look at this as well :
http://support.microsoft.com/kb/289650

rgds,
Edwin.

 

[Sean]

Hello again Edwin,

Yup, I looked up both of those, the first details the issue with 2K3 Server
and XP and this issue is ONLY prevalent on 2K Pro machines.

The second details mobsync in conjunction with offline folders, offline
folders is disabled in group policy for computers so I doubt it is this.

I have just installed WSUS and it shows that my predecessors patch and
update management policy was... well none existant.

Think i'll revisit this when I know all my machines are fully patched.

*Groan*

Heh, this is why I love working in IT.

Thanks again for all your help Edwin.

Sean

 

[Edwin vMierlo]

you're welcome
and
good luck

rgds,
Edwin.

Hello again Edwin,

Yup, I looked up both of those, the first details the issue with 2K3 Server
and XP and this issue is ONLY prevalent on 2K Pro machines.

The second details mobsync in conjunction with offline folders, offline
folders is disabled in group policy for computers so I doubt it is this.

I have just installed WSUS and it shows that my predecessors patch and
update management policy was... well none existant.

Think i'll revisit this when I know all my machines are fully patched.

*Groan*

Heh, this is why I love working in IT.

Thanks again for all your help Edwin.

Sean