Windows 2003 Event Id 10009

Windows 2003 R2 Enterprise Edition SP2
Member of Domain

Started receiveing Event 10009 errors at start up and every so often.

The ip address that it can not communicate with was changed to another sub net.

I ran netstat -anb

See attached

The ip address that was not communicated with was a valid ip address till we moved it to another sub net.

How do I configure or where do I configure the Windows 2003 server in question to point to a valid address now?

Event Id

Event Type:      Error
Event Source:      DCOM
Event Category:      None
Event ID:      10009
Date:            3/20/2015
Time:            4:40:22 PM
User:            N/A
Computer:      SERV013
Description:
DCOM was unable to communicate with the computer 10.2.8.18 using any of the configured protocols.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


The ip address 10.2.8.18 is now 10.1.8.17   that server also has 10.2.8.17  dual nics

Some config file is pointing to that address not sure where
I searched my registry for that ip address not found


Where can I change this?
netstat.txt
LVL 23
Thomas GrassiSystems AdministratorAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

awawadaCommented:
Thomas GrassiSystems AdministratorAuthor Commented:
Thanks for the info

I checked the registry entry    DCOM Protocols    ncacn_ip_tcp


Do not know why it is looking for that ip address.
awawadaCommented:
Did you check the network Connections?
Acronis True Image 2019 just released!

Create a reliable backup. Make sure you always have dependable copies of your data so you can restore your entire system or individual files.

Thomas GrassiSystems AdministratorAuthor Commented:
Yes

this server communicates with the network with no problems.

I have three applications that run on this server that need to access the entire network / domain they all work

I know it is just a setting some where just can t find it.

The ip address 10.2.8.18 no longer exists on the network and dcom is pointing to that address for some reason.

I checked my DNS and no reference to that ip address I checked WINS database no records for that ip address

I have two DC servers both Windows 2003 that do not have this issue.

Explanation

The network connections might not be configured properly.
 
What network connections they talking about?

Puzzled ???
awawadaCommented:
Do you have a Firewall?
Is LabTech installed?
Can you ping the Server from any client?
Is the Server up-to-date?

Try How to troubleshoot 1- 4:
http://blogs.msdn.com/b/asiatech/archive/2010/03/16/how-to-troubleshoot-dcom-10009-error-logged-in-system-event.aspx

Do you use Windows Firewall? If yes try this:
https://technet.microsoft.com/en-us/library/cc774368(v=WS.10).aspx

Also run this test:
https://support.microsoft.com/en-us/kb/259011
Thomas GrassiSystems AdministratorAuthor Commented:
Do you have a Firewall?      NO
 Is LabTech installed?           NO
 Can you ping the Server from any client? YES
 Is the Server up-to-date? YES

The server it is trying to communicate with Ip address has changed the ip address that shows in the error is not the correct address any longer

I will try the test but I need to find where this old ip address is located on this server getting this error

Thoughts
awawadaCommented:
Ok try all and let me know.
Thomas GrassiSystems AdministratorAuthor Commented:
http://blogs.msdn.com/b/asiatech/archive/2010/03/16/how-to-troubleshoot-dcom-10009-error-logged-in-system-event.aspx

This I already saw no help at all

Do you use Windows Firewall? If yes try this:
https://technet.microsoft.com/en-us/library/cc774368(v=WS.10).aspx


Run Firewall on the Server that is trying to be connected to this is a Windows 2008 Server
The server getting the error 10009 is a windows 2003 server

So I modified the firewall on the windows 2008 server
Check the firewall settings and enable the firewall exception rule

To check the firewall settings and enable the firewall exception rule:
1.Click Start, and then click Run.
2.Type wf.msc, and then click OK. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
3.In the console tree, click Inbound rules.
4.In the list of firewall exception rules, look for COM+ Network Access (DCOM In).
5.If the firewall exception rule is not enabled, in the details pane click Enable rule, and then scroll horizontally to confirm that the protocol is TCP and the LocalPort is 135. Close Windows Firewall with Advanced Security.



I set this up on the Windows 2003 as server and on the windows 2008 as client

Also run this test:
https://support.microsoft.com/en-us/kb/259011 


Ran successfully

Windows 2003 Server
C:\Test>regedit tstsrvr.reg

C:\Test>tstsrvr
Server: Waiting
Server: IClassFactory:CreateInstance\

Windows 2008 Server
C:\Test>tstclnt SERV013.FQDN.com
Client: Creating Instance...0.0922 seconds
Client: Reading data...0.0056 seconds
Client: Writing data...0.0004 seconds
Client: Done
C:\Test>

So it look s good but as I asked in the beginning where is my windows 2003 server getting the old ip address from?

We find that then we resolve the problem
awawadaCommented:
Did you check the DHCP?
Thomas GrassiSystems AdministratorAuthor Commented:
What should I check in DHCP?

Will look at that when I get on site

Thanks
awawadaCommented:
Check if you have a reservation to the old Server.
Thomas GrassiSystems AdministratorAuthor Commented:
Will do

Thanks
awawadaCommented:
Ok give me an update after.
Thomas GrassiSystems AdministratorAuthor Commented:
Just checked DHCP no entries

Note they where all configured manually on the servers.

No DNS entry
No Wins Entry.

Ran arp -a     that ip address not listed in arp cache

Where in the world is this ip address stored on this server
Thomas GrassiSystems AdministratorAuthor Commented:
awawada

Update

I ran this command on the server  ipconfig /displaydns

18.8.2.10.in-addr.arpa
 ----------------------------------------
 Name does not exist.


This is the ip address 10.2.8.18   that is the problem on this server


should I do a ipconfig /flushdns

I checked all other servers non reference this address

Thoughts
Thomas GrassiSystems AdministratorAuthor Commented:
awawada

 Update

 I ran ipconfig /flushdns

then ipconfig /displaydns      and this still appears

 18.8.2.10.in-addr.arpa
  ----------------------------------------
 Name does not exist.

Could this be the issue?

How do I get rid of this?
Steven VellaIT AdviserCommented:
Interesting.  If I have followed this thread correctly.

You've got a server with two NICs at IPs 10.1.8.17 and 10.2.8.17. The first NIC was changed from 10.2.8.18.
But for some reason, DCOM has not picked up the change and is still trying to locate the server on the old IP address. So, of course it can't find it.

The MS troubleshooting links provided, I think are assuming the server is still at the old IP address and offer suggestions to help resolution and pass through the firewall. But this does not seem to be what you need.

This link http://support.microsoft.com/en-us/kb/910695 indicates that reporting of DCOM errors were improved with the hotfix and/or WS2003 SP2, by providing extra details. But, you know the problem, so I am not sure you would find anything new.

However, it also seems like DCOM can be used in programming, refer http://computer-programming-forum.com/64-vb-com/0c55864bbe1dbfb2.htm.  

So, from these clues I would like to offer the following suggestions:

o Maybe the server IP address is hardcoded in an application or in an application parameters.  If this rings any bells, maybe you can go back to a configuration file or program and update its values.

o Also, maybe DCOM hasn't picked up the changes.  Maybe it needs to be stopped and restarted to remove cached entries? http://computerstepbystep.com/dcom_server_process_launcher_service.html

o Finally, the server, DHCP or another device just won't let go of the IP address. Maybe, if you will need to set a maintenance window aside and reboot every network management-type device.
 
Oh and with regard to your ARP command, does ARP -a [inet_addr] [-N if_addr] [-v] command show anything useful i.e. arp -a -v?

I hope this is some help.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Thomas GrassiSystems AdministratorAuthor Commented:
Steve

Found it

Running Opmanager on this server and it had the ip address of the second nic from the server that I removed still in the devices being managed.

Every time it poled this device caused the error.

Will thank you very much
Steven VellaIT AdviserCommented:
That's terrific. I appreciate the feedback.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2003

From novice to tech pro — start learning today.