asked on

How to Troubleshoot DCom Errors

On one of the Windows 2008 Standard (x86) servers in my Windows 2003 level domain, DistributedCOM has been crashing on just about a daily basis. A typical set of the resulting errors is attached, but the first error usually is:

Event 10010, DistrubutedCOM
The server {73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} did not register with DCOM within the required timeout.

After this event, some of the features I've found to stop working include IIS, Windows Modules Installer (TrustedInstaller) service, and a variety of management snap-ins including Disk Management. We have a couple of applications (Control Systems ERS Lasertrak, Sonasoft Sonasafe) whose application interfaces rely upon IIS, and also have on this server McAfee Antivirus Enterprise (8.7i), Microsoft SQL Server 2005, and .Net 1.1.

Could somebody suggest how I might go about troubleshooting what exactly is causing DCom to crash? I am working under the assumption that it is the crash of DCom which is causing the rest of the features to stop working, but if I am incorrect and DCom is crashing because something else is having trouble, please feel free to correct me. Thanks in advance!
DCom-Crash-Events.txt

SOLUTION

wolfman007

membership

Create a free account to see this answer

Signing up is free and takes 30 seconds. No credit card required.

See answer

Dan Carp

ASKER

Thanks wolfman007 - I had started to walk down that same path over the weekend and am fairly certain it's the correct one. See attached for the latest log that I've generated from WMIDiag.

I've cleared out one set of WMI errors that I found, and know that I can ignore the error on line 53225 (it's an issue with the application... see http://blogs.technet.com/askperf/archive/2008/11/11/wmidiag-vbs-and-the-missing-wmi-files.aspx).

But I am having trouble resolving the issue on line 53305. I tried running 'WINMGMT.EXE /SYNCPERF' which didn't fix it. I also followed the instructions starting on line 53345 about running 'MOFCOMP WMIPERFINST.MOF' which didn't solve it. I ran 'WMIDiag WriteInRepository=Root' but I'm not sure what I need to be looking for before knowing that it would be safe to run 'WMIDiag WriteInRepository'.

The other odd thing about it is that I have some WMI entries that are very similar to those which the program notes:

Reported Missing: Win32_PerfFormattedData_TermService_TerminalServices
Exists on system: Win32_PerfFormattedData_TermService_TerminalServicesSession

Reported Missing: Win32_PerfRawData_TermService_TerminalServices
Exists on system: Win32_PerfRawData_TermService_TerminalServicesSession

Are these really two different items? Unfortunately the only other two Windows 2008 Servers I have in house are x64 so I can't confirm that the reported missing entries should exist. Thanks again for any help.
WMIDIAG-V2.0-6001-.SRV.RTM.32-20.TXT