Please help

[haverlyr]

I am receiving hundreds of security messages suchs as the one below:
and the only thing different is that we have recently installed SMS and WSUS
Here is the message on one of the 1000s clients.
There are also BIT errors withing the system log too.

On the SMS server we have tons of DCOM erros which is the last message below

Any ideas.
Please reply and send message to robert.haverly@wishard.edu


Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 3/30/2007
Time: 8:26:39 PM
User: NT AUTHORITY\NETWORK SERVICE
Computer: xxxxx
Description:
Object Open:
Object Server: SC Manager
Object Type: SERVICE OBJECT
Object Name: BITS
Handle ID: -
Operation ID: {0,7371916}
Process ID: 700
Image File Name: C:\WINDOWS\system32\services.exe
Primary User Name: xxxxxxxx
Primary Domain: xxxxxxx
Primary Logon ID: (0x0,0x3E7)
Client User Name: NETWORK SERVICE
Client Domain: NT AUTHORITY
Client Logon ID: (0x0,0x3E4)
Accesses: READ_CONTROL
Query service configuration information
Query status of service
Enumerate dependencies of service
Query information from service

Privileges: -
Restricted Sid Count: 0


For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

DCOM was unable to communicate with the computer xxxxx using any of the
configured protocols.

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10009
Date: 3/30/2007
Time: 5:01:38 PM
User: N/A
Computer: xxxxxxx
Description:
DCOM was unable to communicate with the computer xxxxxxxx using any of the
configured protocols.

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

DCOM was unable to communicate with the computer xxxxx using any of the configured protocols.

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10009
Date: 3/30/2007
Time: 5:01:38 PM
User: N/A
Computer: xxxxxxx
Description:
DCOM was unable to communicate with the computer xxxxxxxx using any of the configured protocols.

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 3/30/2007
Time: 11:21:42 PM
User: N/A
Computer: xxxxxxx
Description:
The Background Intelligent Transfer Service service terminated with service-specific error 2147500053 (0x80004015).

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 63
Date: 3/30/2007
Time: 7:25:55 PM
User: NT AUTHORITY\SYSTEM
Computer: xxxxxx
Description:
A provider, PolicyAgentInstanceProvider, has been registered in the WMI namespace, root\CCM\Policy\S_1_5_21_2111000606_202995351_1780572237_19039, to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

 

[tbrennans]

Hmm well it looks like the bits service is trying to use the network service account when I beleive it should be using the local system account and be set to manual.

 

[haverlyr]

So where should I make the changes, and how?

 

[tbrennans]

Services then go to the bits service, general tab should be set to manual then the logon tab and switch it to Local SYStem account.

I would see why it was set to something else if this is the case, as by default it should be setup that way, and the only reason it would have changed is someone or something changed it.....so dont break something else ;-)

 

[haverlyr]

It was already set to local service