skunkx3
asked on
Symantec Endpoint Protection LiveUpdate DCOM error
I'm having DCOM error on a computer with Symantec Endpoint Protection 11.0.4202.75 and Live Update 3.3.
Everything was ok for 6 months on ~50 computers and now i'm having this error on an important computer.
The probleme occurs for the first time on October 29 a second time November 19.
Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10000
Date: 2009-11-19
Time: 15:23:01
User: AUTORITE NT\SYSTEM
Computer:
Unable to start a DCOM Server: {7E477741-01A6-4C06-9DAC-5
The error:"Insufficient system resources exist to complete the requested service.
"Happened while starting this command:C:\Program Files\Symantec\Symantec Endpoint Protection\SescLU.exe -Embedding
Nothing change on this computer, no new update, no new hardware, no new program.
When the problem occurs we can't use the computer and we need to restart it.
Why this probleme occurs every three weeks?
The client take are update from Symantec Endoint Protection Manager and the server check for update every 4 hours.
Somebody have a solution?
Anyone have the same problem?
I ask an update on Symantec Forum because somebody had the same problem but there is no solution: http://www.symantec.com/connect/forums/unable-start-dcom-server
Thanks!
Jim
Everything was ok for 6 months on ~50 computers and now i'm having this error on an important computer.
The probleme occurs for the first time on October 29 a second time November 19.
Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10000
Date: 2009-11-19
Time: 15:23:01
User: AUTORITE NT\SYSTEM
Computer:
Unable to start a DCOM Server: {7E477741-01A6-4C06-9DAC-5
The error:"Insufficient system resources exist to complete the requested service.
"Happened while starting this command:C:\Program Files\Symantec\Symantec Endpoint Protection\SescLU.exe -Embedding
Nothing change on this computer, no new update, no new hardware, no new program.
When the problem occurs we can't use the computer and we need to restart it.
Why this probleme occurs every three weeks?
The client take are update from Symantec Endoint Protection Manager and the server check for update every 4 hours.
Somebody have a solution?
Anyone have the same problem?
I ask an update on Symantec Forum because somebody had the same problem but there is no solution: http://www.symantec.com/connect/forums/unable-start-dcom-server
Thanks!
Jim
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Here is the more detailed steps:
To verify Distributed COM properties
On the Windows taskbar, click Start > Run.
Type the following, and then click OK:
dcomcnfg
Do one of the following, depending on your operating system:
In Windows XP/2003, click Component Services > Computers > My Computer. Then right-click My Computer and click Properties.
In all other versions of Windows, go on to the next step.
On the Default Security or Default COM Security tab, under Default Access Permissions, click Edit Default.
Verify that Administrators, Interactive, and System accounts are set to Allow Access, and then click OK.
Under Default Launch Permissions, click Edit Default.
Verify that the Administrators, Interactive, and System accounts are set to Allow Launch, and click OK.
Do one of the following, depending on your operating system:
In Windows XP/2003, skip the two following steps.
In all other versions of Windows, go on to the next step.
In the Default Configuration Permissions section, click Edit Default.
In the Registry Key Permissions window, verify that the following are set to Full Control, and then click OK:
CREATOR OWNER
...\Administrators
SYSTEM
On the Default Properties tab, verify that Default Impersonation Level is set to Identify.
Click Apply, and then click OK.
Restart the computer for the changes to take effect.
To verify Distributed COM properties
On the Windows taskbar, click Start > Run.
Type the following, and then click OK:
dcomcnfg
Do one of the following, depending on your operating system:
In Windows XP/2003, click Component Services > Computers > My Computer. Then right-click My Computer and click Properties.
In all other versions of Windows, go on to the next step.
On the Default Security or Default COM Security tab, under Default Access Permissions, click Edit Default.
Verify that Administrators, Interactive, and System accounts are set to Allow Access, and then click OK.
Under Default Launch Permissions, click Edit Default.
Verify that the Administrators, Interactive, and System accounts are set to Allow Launch, and click OK.
Do one of the following, depending on your operating system:
In Windows XP/2003, skip the two following steps.
In all other versions of Windows, go on to the next step.
In the Default Configuration Permissions section, click Edit Default.
In the Registry Key Permissions window, verify that the following are set to Full Control, and then click OK:
CREATOR OWNER
...\Administrators
SYSTEM
On the Default Properties tab, verify that Default Impersonation Level is set to Identify.
Click Apply, and then click OK.
Restart the computer for the changes to take effect.
ASKER
The error does not occur on a server, but on a client workstation which is used by the VP.
I checked the DCOM security tab and there is two group in the box:
SELF and SYSTEM.
I checked a couple of computer and everyone had the same configuration in DCOM and there is no problem on the other computer.
I will wait next week to see if it's happen again on december 10 to confirm the 3 weeks delay and after i will try to reinstall LiveUpdate.
Thanks
I checked the DCOM security tab and there is two group in the box:
SELF and SYSTEM.
I checked a couple of computer and everyone had the same configuration in DCOM and there is no problem on the other computer.
I will wait next week to see if it's happen again on december 10 to confirm the 3 weeks delay and after i will try to reinstall LiveUpdate.
Thanks
Hi,
For client workstation too.. these options should be there.
You have just checked under Access permissions field.
Also edit the default "Launch and Activation" permissions. There you will find the rest of options.
Regards,
Pradeep Jhala
For client workstation too.. these options should be there.
You have just checked under Access permissions field.
Also edit the default "Launch and Activation" permissions. There you will find the rest of options.
Regards,
Pradeep Jhala
ASKER
The first sentence did not make reference to what you said.
I already checked the DCOM security and told you the result.
Everything seems to be OK for DCOM security.
Thanks!
Jim
I already checked the DCOM security and told you the result.
Everything seems to be OK for DCOM security.
Thanks!
Jim
ASKER
I used Symantec Clean Wipe to Uninstall all Symantec Product and reinstalled Symantec Endpoint Protection and that Seem to have solved the problem.
ASKER
I used Symantec Clean Wipe to Uninstall all Symantec Product and reinstalled Symantec Endpoint Protection and that Seem to have solved the problem
You can close this post.
Thanks!
Jim
You can close this post.
Thanks!
Jim
Please check the DCOM settings as below:
Configure proper DCOM settings:
-> On the Windows taskbar, click Start > Run.
--> In the Open box, type the following text:
dcomcnfg.exe
--> Click OK.
Expand Component Services, and then expand Computers. Right-click My Computer, and then click Properties. On the Default COM Security tab, under Access Permissions, Edit Default.
---> The Access Permission pane is normally blank. If the window is not blank, make sure that the Administrators, Interactive, and System accounts are set to Allow Access. .
Regards,
Pradeep Jhala