troubleshooting Question

SQL or Permission problem?

Avatar of Rob Stone
Rob StoneFlag for United Kingdom of Great Britain and Northern Ireland asked on
Microsoft SQL Server 2005Microsoft IIS Web ServerWindows Server 2003
5 Comments1 Solution706 ViewsLast Modified:
Hi,
I am looking after a tiered system which has two IIS servers connecting to a SQL server.

I also changed the NTFS permissions on the servers through a GPO recently (which ties in to the problem start date) where I overwrote settings instead of appending them.

From the website test the MSDTC fails to communicate. I've checked the settings in the DCOM, System, MSDTC, Security settings and they are correct.  I have also ran sc sdshow and got the following response:
D:(A;;CCLCSWRPLOCRRC;;;S-1-2-0)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOC
RSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;CCLCSWRPRC;
;;WD)(A;;CCLCSWRPLORC;;;NS)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

This is consistant on all 3 servers and another server in a different environment which does work so I presume this is OK?

I am also getting a number of event logs (full auditing on fail is on) like this:
Event Type:      Failure Audit
Event Source:      Security
Event Category:      Object Access
Event ID:      560
Date:            11/12/2008
Time:            14:24:46
User:            DOMAIN\SERVICE ACCOUNT 1
Computer:      COMPUTERNAME
Description:
Object Open:
       Object Server:      SC Manager
       Object Type:      SC_MANAGER OBJECT
       Object Name:      ServicesActive
       Handle ID:      -
       Operation ID:      {0,184791139}
       Process ID:      716
       Image File Name:      C:\WINDOWS\system32\services.exe
       Primary User Name:      COMPUTERNAME$
       Primary Domain:      DOMAIN
       Primary Logon ID:      (0x0,0x3E7)
       Client User Name:      SERVICE ACCOUNT1
       Client Domain:      DOMAIN
       Client Logon ID:      (0x0,0x7670151)
       Accesses:      READ_CONTROL
                  Connect to service controller
                  Enumerate services
                  Query service database lock state
                  
       Privileges:      -
       Restricted Sid Count:      0
       Access Mask:      0x20015

This error occurs when the tests are run which would indicate some of the problem.  This error only started after my permissions error.

The system test fails on MSDTC Write Test. See error log below.

Reference Number 081211165707-7 Session ID = 8fac38e1-272a-4b24-9a5a-7caa202a213c Insight Exception Occurred:

Communication with the underlying transaction manager has failed.

   at System.Transactions.TransactionInterop.GetOletxTransactionFromTransmitterPropigationToken(Byte[] propagationToken)
   at System.Transactions.TransactionStatePSPEOperation.PSPEPromote(InternalTransaction tx)
   at System.Transactions.TransactionStateDelegatedBase.EnterState(InternalTransaction tx)
   at System.Transactions.EnlistableStates.Promote(InternalTransaction tx)
   at System.Transactions.Transaction.Promote()
   at System.Transactions.TransactionInterop.ConvertToOletxTransaction(Transaction transaction)
   at System.Transactions.TransactionInterop.GetExportCookie(Transaction transaction, Byte[] whereabouts)
   at System.Data.SqlClient.SqlInternalConnection.EnlistNonNull(Transaction tx)
   at System.Data.SqlClient.SqlInternalConnection.Enlist(Transaction tx)
   at System.Data.SqlClient.SqlInternalConnectionTds.Activate(Transaction transaction)
   at System.Data.ProviderBase.DbConnectionInternal.ActivateConnection(Transaction transaction)
   at System.Data.ProviderBase.DbConnectionPool.GetConnection(DbConnection owningObject)
   at System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection)
   at System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory)
   at System.Data.SqlClient.SqlConnection.Open()
   at VENDOR.Insight.DataAccess.DBAccess.RunNonQueryCommandWithResult()
   at VENDOR.Insight.DataAccess.DBAccess.RunCommandWithResult()
   at VENDOR.Insight.DataAccessComponents.DACClient.SaveFromEntity(BEClient entity, String sessionID, Boolean insert)
   at VENDOR.Insight.DataAccessComponents.DACClient.Create(BEClient entity, String sessionID)
   at VENDOR.Insight.BusinessComponents.BCClient.SaveClient(BEClient entity, String userID, String sessionID)
   at VENDOR.Insight.BusinessWorkflows.BWClient.InternalSave(BEClient client, String userID, String sessionID)
   at VENDOR.Insight.BusinessWorkflows.BWClient.Save(BEClient client, String userID, String sessionID)


Reference Number 081211165707-8 Session ID = 8fac38e1-272a-4b24-9a5a-7caa202a213c Insight Exception Occurred:

Test Error - Raised by testing the system

Event logs on the SQL server are not showing anything in the same time period which could indicate the problem, nor the Services IIS server. The Internet IIS server appears to be the problem server (event log anyway).

I'm wondering if the Network Service account should have access to something it currently doesn't have, but I can't figure out what.  That is what the MSDTC is using.

I do have alternative environments to compare the settings against, there are just a lot of settings!

Any help appriciated.
ASKER CERTIFIED SOLUTION
Rob Stone

Our community of experts have been thoroughly vetted for their expertise and industry experience.

Join our community to see this answer!
Unlock 1 Answer and 5 Comments.
Start Free Trial
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 1 Answer and 5 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros