Pesky DCOM error in system log repeats ~ every minute

[dalchri]

I have the following error message saturating my system event log on my PDC. It repeats about every minute or so.

----------------------------------------------------------
Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10004
Date: 12/30/2004
Time: 9:56:40 AM
User: N/A
Computer: SERVER1
Description:
DCOM got error "Overlapped I/O operation is in progress. " and was unable to logon APEXHOMES\administrator in order to run the server:
{888E219E-555B-413C-AA42-56BF812D7EF3}

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

--------------------------------------------------------

I have looked for the GUID {888E219E-555B-413C-AA42-56BF812D7EF3} in the registry and it is not present. So I am not certain that the error is "unable to log on" as much as the DCOM server is not even present or installed.

The server shows no ill effects otherwise so I don't think I'll be needing the DCOM server. Anyone have an idea how I can figure out what process is requesting the DCOM server?

I would like to either stop the process requesting the DCOM server or reconfigure it to work without the DCOM server. Either way, I need to know the name of the process first!

Thanks for suggestions!

 

[dalchri]

Nevermind, I found it. It was a 3rd party demo product hooked into Exchange that had expired.

I was rather surprised to find that the GUIDs for the DCOM components under Component Services are not listed in the registry.

 

[vkode78]

Hi I am having similar error
DCOM got error "Logon failure: unknown user name or bad password. " and was unable to logon XXX\administrator in order to run the server:
{888FC943-CB7D-43E7-BB64-905342B0D34D}

How can I find out what is causing this error. You said you were able to find out that it is a 3rd party demo. Can any one help? I really would like to get this resolved, because lately our Veritas backups are not completing, they take 20 hours and on and never complete, and they stall when backing up exchange store. I am wondering if these two are related.

Thanks

 

[dalchri]

I found my GUID by going to:

Control Panel
Administrative Tools
Component Services

Then from that Snap-In:

Console Root
Component Services
Computers
My Computer

After that I interrogated every installed DCOM component under the COM+ Applications and DCOM Config categories by right clicking, selecting properties, and checking the GUID against the GUID listed in the event log.

In my specific case, it turned out to be an expired demo email virus scanner that hooks itself into Exchange.

A search of the registry for that GUID wouldn't hurt either.

Once you identify the offending component, try to uninstall/reinstall the application it belongs to.