Announcement

Collapse
No announcement yet.

Hundreds of event 3019 and 10016

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Hundreds of event 3019 and 10016

    On most (if not all) of the computers on our domain are showing the following errors in the event log:

    Code:
    Application Log:
    Source: Userenv
    Event ID: 1054
    Windows cannot obtain the domain controller name for your computer network. (The specified domain either does not exist or could not be contacted). Group Policy processing aborted. 
    
    Followed immediately by:
    Source: AutoEnrollment
    Event ID: 15
    Automatic certificate enrollment for local system failed to contact the active directory (0x8007054b).  The specified domain either does not exist or could not be contacted.
      Enrollment will not be performed.
    
    System Log:
    Source: MRxSmb
    Event ID: 3019
    The redirector failed to determine the connection type.
    
    Source: DCOM
    Event ID: 10016
    The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
    {24FF4FDC-1D9F-4195-8C79-0DA39248FF48}
     to the user NT AUTHORITY\SYSTEM SID (S-1-5-18).  This security permission can be modified using the Component Services administrative tool.
    1054/15 happen when the user logs on just after the PC has started. They obviously then do not get there mapped drives (logon script). If the user waits, logs off/on, then it is fine.

    Error 3019 seems like it is happening randomly throughout the day, I'm guessing when the user is doing something. This results in hundreds of them in the event log. These are interspersed with the DCOM event, again at random times , but still maybe 20 or 30 times a day.

    I have looked at MANY various MS KB's, but they only seem to apply to this occuring once or twice. None of them seem to apply to Domain computers. Google hasn't helped either.

    Any ideas?
    Last edited by swfblade; 23rd October 2009, 16:08. Reason: Updating title and events
    James
    MCP

  • #2
    Re: Hundreds of event 3019 and 10016

    Should have added thats its Windows 2003 domain, all PC's running XP Pro.
    James
    MCP

    Comment


    • #3
      Re: Hundreds of event 3019 and 10016

      Have you run dcomcnfg on one of the machines to find out what the application is?

      Comment


      • #4
        Re: Hundreds of event 3019 and 10016

        yes, it doesn't appear in the list
        James
        MCP

        Comment


        • #5
          Re: Hundreds of event 3019 and 10016

          It must be a Windows component as a registry search for {24FF4FDC-1D9F-4195-8C79-0DA39248FF48} finds this AppID: {B292921D-AF50-400c-9B75-0C57A7F29BA1}. Run dcomcnfg again and look for {B292921D-AF50-400c-9B75-0C57A7F29BA1}.

          Comment


          • #6
            Re: Hundreds of event 3019 and 10016

            It looks like it's the NAP Service Agent. The one on my machine has the following on the Security tab:

            Launch and Activation Permissions is set to Customize. Clicking the Edit button shows these permissions:

            Authenticated Users = Local Activation
            Network Service = Local Activation
            System = Local Activation

            Comment


            • #7
              Re: Hundreds of event 3019 and 10016

              So why has this suddenly started happening on ALL the PC's on our Domian controlled network?
              James
              MCP

              Comment


              • #8
                Re: Hundreds of event 3019 and 10016

                No idea but have you checked it yet in dcomcnfg based on the info I posted yesterday?

                Comment


                • #9
                  Re: Hundreds of event 3019 and 10016

                  Originally posted by swfblade View Post
                  On most (if not all) of the computers on our domain are showing these 2 errors in the event log:

                  Code:
                  Source: MRxSmb
                  Event ID: 3019
                  The redirector failed to determine the connection type.
                  
                  Source: DCOM
                  Event ID: 10016
                  The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
                  {24FF4FDC-1D9F-4195-8C79-0DA39248FF48}
                   to the user NT AUTHORITY\SYSTEM SID (S-1-5-18).  This security permission can be modified using the Component Services administrative tool.
                  The first error is happening randomly throughout the day, I'm guessing when the user is doing something. This results in hundreds of them in the event log. These are interspersed with the DCOM event, again at random times , but still maybe 20 or 30 times a day.

                  I have looked at various MS KB's, but they only seem to apply to this occuring once or twice. None of them seem to apply to Domain computers. Google hasn't helped either.

                  Any ideas?
                  the 10016 error occured after a service pack release on Windows 2003. They tighteneed down security on the com components, and there's definitely a fix for this as i've done it over 30 times.

                  http://support.microsoft.com/kb/899965

                  hope this helps..
                  Please do show your appreciation to those who assist you by leaving Rep Point https://www.petri.com/forums/core/im.../icon_beer.gif

                  Comment


                  • #10
                    Re: Hundreds of event 3019 and 10016

                    joeqwerty, Sorry not had a chance yet.

                    tehcamel, but I haven't applied a SP for a long time and this is has only just started. The KB you have posted also seems to apply to x64 versions, but we are using 32bit. Aside from that, I dont really want to have to go to each and every PC in our office and apply this fix! It'd take me days !!
                    James
                    MCP

                    Comment


                    • #11
                      Re: Hundreds of event 3019 and 10016

                      joeqwerty, I've been trying to take a look at a PC I've setup next to me, logged in as a Domain User. So far I haven't been able to replicate the error on this machine, so haven't been able to check it out. It's a bit difficult to get to other's PC's as they are using them and can't really be having too much downtime. Soon as I have a response however i'll post back
                      James
                      MCP

                      Comment


                      • #12
                        Re: Hundreds of event 3019 and 10016

                        right, I have tried DCOMCNFG as the Domain User. I get an alert saying:

                        DTC Console Message
                        You do not have permissions to manage the MS DTC on this system.
                        MS DTC administrative functionality will be disabled.

                        If I then try to look at the security of that NAP service, all the options are greyed out, and none of the radials have any marks in them...
                        James
                        MCP

                        Comment


                        • #13
                          Re: Hundreds of event 3019 and 10016

                          You'll probably need to login as an administrator and check it.

                          Comment


                          • #14
                            Re: Hundreds of event 3019 and 10016

                            Which I also did, just to see. Set as yours under the admin account. (I'm guessing then that this is not controlled by domain permissions?)
                            James
                            MCP

                            Comment


                            • #15
                              Re: Hundreds of event 3019 and 10016

                              any more ideas anyone? Is this controlled by Domain permissions? I really don't want to have to go to each and every computer in the company to sort this, that would take a LONG time... :S
                              James
                              MCP

                              Comment

                              Working...
                              X