DCOM event id 10009

[josh2009]

every 30 mins we get the event id 10009 on the sbs 2008 box for ALL pc's on the network. This just started 2 nights ago for no apparent reason.
"DCOM was unable to communicate with the computer xxx using any of the configured protocols."
The security status for all pc's is showing as 'not available' in the sbs console, although status is online.
Can anyone advise please?

 

[kurio71]

Could be TCP/IP errors. I had this error for one PC and manually installed an update that failed and rebooted.

Level 1 Support Technician

 

[kurio71]

Found this

http://support.microsoft.com/default.aspx?scid=kb;en-us;957713

Level 1 Support Technician

 

[josh2009]

all workstations are on the same subnet as the SBS server but I edited the gpo to allow inbound file and printer sharing exception, inbound remote administration exception and inbound remote desktop exceptions. This did not work.
I can ping all the pc's via ip and name.
Have disabled the sbs windows firewall to no avail.

 

[seaport]

I got the same error but maybe a different situation. One workstation was power off for a long time. Then I found out this error in the System Event Log. It generated over 10,000 error entries in a month. How do I stop DCOM from retrying the connection?

 

[josh2009]

some further info - PID 988 c:\windows\system32\svchost.exe -k rpcss is referenced in the event id 10009. Can anyone assist on how I can proceed to fix this

 

[kurio71]

Look at the Remote Procedure Call Service.

Level 1 Support Technician

 

[ShackDaddy]

Are all the computers in the SBS Computers OU under the MyBusiness\Computers containers? If they aren't, then group policies which make the proper firewall exceptions may not be applied, and that may be the cause of the DCOM errors.

This is probably the document with the most authoritative answer:

http://support.microsoft.com/kb/957713

Dave Shackelford
ThirdTier.net
TrainSignal.com

 

[josh2009]

yes all the pc's are in the mybusiness\computers\sbscomputers container.
I have phoned both HP and Symantec and both say it is a Microsoft issue.

 

[ShackDaddy]

Honestly, I've worked on 100+ SBS servers, and more than 60% have this issue. I've just started to ignore it and always filter it out of the event logs when checking for issues.

Dave Shackelford
ThirdTier.net
TrainSignal.com

 

[josh2009]

i have 4000 dcom events now in the last 3 weeks. The last few days they have started to occur every hour, rather than on the half hour up till then.
The server has been in operation for over a year and it's just recently these started out of the blue for no apparent reason.
The last thing for me to try is a restart.

 

[josh2009]

I restarted the server and no dcom errors for the moement anyway. Also, security status is no longer showing not available in the sbs console, but displays OK.