DCOM Event ID 10006

Kenzii used Ask the Experts™
Our servers (Server 2003) event log is getting flooded with the following:

* Event Time: 21 May 2012 08:33:04 AM
* Source: DCOM
* Event Log: System
* Type: Error
* Event ID: 10006
* Event User: N/A
* DCOM got error "%2147944122" from the computer WIN7-PC8 when attempting to
activate the server:

I have been looking into it and i came across this possible fix:

But neither of the hotfixes are compatible with the server.
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Rich WeisslerProfessional Troublemaker^h^h^h^h^hshooter

{8BC3F05E-D86B-11D0-A075-00C04FB68820} is the Windows Management Interface (WMI).

I assume WIN7-PC8 is a client machine in your environment, and it is reporting back to your server with this error?  

Did this start recently?  Any significant changes in the environment?  Any new software (which might rely on WMI) rolled out to all affected machines?


Yes this is happening to quite a few windows 7 machines that report back to this server.
This has been populating for a few months now, no real change in environment that would trigger something off like this, no new software has been installed
Rich WeisslerProfessional Troublemaker^h^h^h^h^hshooter

Is "Windows Management Instrumentation" running on the Windows 7 machines?  (Or is it failing to start, giving this error?  I assume it is currently stopped, and you can cause it to give the error at will by attempting to start that service.)

On the Windows 7 machines, check the application or system (or even security) logs -- is there a different message which would correspond with the error you are seeing on the server?  A message in one of those logs may provide additional information concerning what is really causing the problem.  

If you open up 'Component Services' from 'Administrative Tools' on one of the Windows 7 machines, go down to Computers, My Computer, DCOM Config... "Windows Management and Instrumentation" is the specific DCOM component we are looking at.  I hate to guess what needs to change at this point... but it might be security related in there.  I believe worst case - you could make the error stop by un-selecting 'Run application on this computer'... which I'm not suggesting you do... unless done on one machine you don't really love, purely for testing to see what else fails because it is relying on this component.
11/26 Forrester Webinar: Savings for Enterprise

How can your organization benefit from savings just by replacing your legacy backup solutions with Acronis' #CyberProtection? Join Forrester's Joe Branca and Ryan Davis from Acronis live as they explain how you can too.


Just to inform you, we are getting more DCOM errors for Event ID 10009:

DCOM was unable to communicate with the computer <ComputerName> using any of the configured protocols.
Rich WeisslerProfessional Troublemaker^h^h^h^h^hshooter

Was the DCOM 10009 error reported on the server, or the Windows 7 client machine?
Was <ComputerName> the server, or the Windows 7 client machine?

If the error is reported on the server, and <ComputerName> is the client -- are tcp/135 and tcp/445 open from the server to the client(s)?  Is there a firewall configured on the client(s)?
The DCOM error was reported on the server.
<Computer name> is the client machine.

The ports are open and firewalls are disabled


No longer required

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial