RE: DCOM Server Event ID 10003
![Brandy Nee [MSFT]'s profile photo](https://lh3.googleusercontent.com/a/default-user=s40-c)
Brandy Nee [MSFT]
Thank you for posting to the SBS Newsgroup.
I understand that from the server usage report, you noticed that your
server got EVENT ID 10003, and you are worrying whether your network is
being secure protected. If I have misunderstood your concern, please let me
know.
A registry search on this shows that {00020906-0000-0000-C000-000000000046}
is Microsoft Word Document. It seems that something is attempting to create
an instance of a word application / a word document using DCOM.
Please try the following steps and see if the problem persists:
1. Click Start, click Run, type "dcomcnfg" (without the quotation marks),
and then click OK.
2. Expand to Console Root\Component Services\Computers\My Computer. Right
click My Computer, go to Properties.
3. On the "Default Properties" tab, set "Default Authentication Level" to
Connect and set "Default Impersonation Level" to "Identify".
4. On the Application tab, select Microsoft Word Document and click
Properties.
5. On the Security tab, select "Use custom launch permissions" and click
Edit.
6. Check if SYSTEM has the "Allow Launch" permission. If SYSTEM has the
permission already, click Cancel, and then switch to the General tab, set
the Authentication Level to "None".
7. Click OK twice and restart computer.
If the resolution above does not help, try the following:
a. On the server, go to Start, click Run, type "regedit" (without the
quotation marks).
b. Export HKEY_CLASSES_ROOT\CLSID\{00020906-0000-0000-C000-000000000046}
from the registry.
c. Delete the above key.
d. Control Panel -> Add/Remove Programs, repair Microsoft Word.
If you suspect that your network is being attacked from the Internet, I
suggest you read the following document. This document helps you to more
securely configure your Microsoft Windows Small Business Server 2003
network. Completing the tasks in this document helps you protect the
availability, integrity, and confidentiality of your network.
Securing Your Windows Small Business Server 2003 Network
http://www.microsoft.com/technet/prodtechnol/sbs/2003/maintain/sbsecnet.mspx
Hope this information helps. If anything is unclear, please feel free to
let me know. I am looking forward to your reply!
Best regards,
Brandy Nee
Microsoft CSS Online Newsgroup Support
Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.
Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.
For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.
Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
>Thread-Topic: DCOM Server Event ID 10003
>thread-index: AcWu/d5knfHqbGWWR3CaxKlBdzcylQ==
>X-WBNR-Posting-Host: 69.14.191.6
>From: "=?Utf-8?B?Umlja0FsbGVuUw==?=" <RickA...@discussions.microsoft.com>
>Subject: DCOM Server Event ID 10003
>Date: Thu, 1 Sep 2005 07:03:03 -0700
>Lines: 17
>Message-ID: <00E4644A-7892-41ED...@microsoft.com>
>MIME-Version: 1.0
>Content-Type: text/plain;
> charset="Utf-8"
>Content-Transfer-Encoding: 7bit
>X-Newsreader: Microsoft CDO for Windows 2000
>Content-Class: urn:content-classes:message
>Importance: normal
>Priority: normal
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
>Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGXA02.phx.gbl!TK2MSFTNGXA03.phx.gbl
>Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:149894
>X-Tomcat-NG: microsoft.public.windows.server.sbs
>
>For the last couple of days, I have been receiving the following message
in
>my usage report:
>
>"Access denied attempting to launch a DCOM Server using
>DefaultLaunchPermssion. The server is:
{00020906-0000-0000-C000-000000000046}
>The user is ANONYMOUS LOGON/NT AUTHORITY, SID=S-1-5-7."
>
>This message is listed with Event ID 10003 and it says there were 19
>occurences.
>
>I am concerned that somebody is trying to hack my system. Or worse yet
that
>the 20th try worked. Can anybody tell me how to analyze this concern and
find
>out what is going on? Any help would be greatly appreciated.
>
>Thanks!!!
>
>Rick
>
RickAllenS
I suppose this informtaion might be helpful to me if I understood what it
meant. I don't know what DCOM is. I don't understand how they would be
attempting to launch a DCOM server. And I don't understand what Microsoft
Word has to do with it.
The message that goes with this error message is:
"Access denied attempting to launch a DCOM Server using
DefaultLaunchPermssion. The server is: {00020906-0000-0000-C000-000000000046}
The user is ANONYMOUS LOGON/NT AUTHORITY, SID=S-1-5-7."
I don't want to give anyone permission to do this and that's what it looks
like your instructions are telling me to do . . .
If you could clarify, I would appreciate it.
Thanks!
Rick
RickAllenS
Hi Brandy,
> 1. Click Start, click Run, type "dcomcnfg" (without the quotation marks),
> and then click OK.
>
> 2. Expand to Console Root\Component Services\Computers\My Computer. Right
> click My Computer, go to Properties.
>
> 3. On the "Default Properties" tab, set "Default Authentication Level" to
> Connect and set "Default Impersonation Level" to "Identify".
DONE
> 4. On the Application tab, select Microsoft Word Document and click
> Properties.
There is no application tab.
> 5. On the Security tab, select "Use custom launch permissions" and click
> Edit.
There is a DCOM Security tab but there is no place to select "Use custom
launch permissions." I selected edit permissions instead.
> 6. Check if SYSTEM has the "Allow Launch" permission. If SYSTEM has the
> permission already, click Cancel, and then switch to the General tab, set
> the Authentication Level to "None".
System has perssion for launch as does IIS, Guest, Interactive, and
Administrator.
There are no options on the general tab.
> 7. Click OK twice and restart computer.
I will try restarting the computer and let you know what happened.
Brandy Nee [MSFT]
Thank you for posting back!
The steps in my last reply do not mean to assign permissions to your domain
clients. Please understand that the issue may be caused if any application
on the SBS 2K3 Server needs to run by Microsoft Word Document.
Please check whether you have installed Outlook on the server, or install
any other MS Office Application and check whether there is any application
uses Microsoft Office Word to edit.
For Windows 2003, Go to DCOMCNFG and edit the Default Access and Default
Launch Permission for MS Word and add Anonymous Logon user with Allow
permission in both the places.
To do so:
1. Click Start, click Run, type "dcomcnfg" (without the quotation marks),
and then click OK.
2. Expand to Console Root\Component Services\Computers\My Computer\DCOM
Config. On the right pane, right click Microsoft Office Word, and select
Properties.
3. On the Security tab, under Launch and Activation Permissions, select
Customize, click Edit. Add "SYSTEM" and "Anonymous Logon" with Allow
Permissions.
4. Still on the Security tab, under Access Permissions, select Customize,
click Edit. Add "SYSTEM" and "Anonymous Logon" with Allow Permissions.
[Note]: Make sure there is no any Deny box being checked.
5. Click OK.
NOTE: Restart the System after making the above changes.
Thanks for your time. If anything is unclear, please feel free to let me
know. I am looking forward to hearing from you!
Best regards,
Brandy Nee
>thread-index: AcWwx2HptO3k14zlQPufr29jTEMu9g==
>X-WBNR-Posting-Host: 69.14.191.6
>From: "=?Utf-8?B?Umlja0FsbGVuUw==?=" <RickA...@discussions.microsoft.com>
>References: <00E4644A-7892-41ED...@microsoft.com>
<#8uZ5I4r...@TK2MSFTNGXA01.phx.gbl>
>Subject: RE: DCOM Server Event ID 10003
>Date: Sat, 3 Sep 2005 13:38:03 -0700
>Lines: 39
>Message-ID: <C92E9B07-9099-478A...@microsoft.com>
>MIME-Version: 1.0
>Content-Type: text/plain;
> charset="Utf-8"
>Content-Transfer-Encoding: 7bit
>X-Newsreader: Microsoft CDO for Windows 2000
>Content-Class: urn:content-classes:message
>Importance: normal
>Priority: normal
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
>Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGXA03.phx.gbl
>Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:150493
>X-Tomcat-NG: microsoft.public.windows.server.sbs
RickAllenS
I wanted to let you know that I haven't received any error messages during
the last few days. However, I have a couple of questions:
What is a DCOM Server?
What types of applications on Windows 2003 SBS Premium would try to open a
Microsoft Word Document?
Thanks for your help!!
Rick
Brandy Nee [MSFT]
Thank you for posting back!
Short for Distributed Component Object Model, an extension of the Component
Object Model (COM) that allows COM components to communicate across network
boundaries. DCOM uses the RPC mechanism to transparently send and receive
information between COM components (i.e., clients and servers) on the same
network.
For more information, please read the following Document:
COM: Component Object Model Technologies
http://www.microsoft.com/com/default.mspx
This issue may occur if you installed Outlook on the server or any other
software needs to run or edited by Microsoft Office Word. Actually, this is
permission issue, it is nothing about DCOM server.
By the way, may I know whether you have tried my steps in my last reply?
Thanks for your time. If you still have any questions or concerns, please
feel free to let me know. I am glad to be of assistance!
Best regards,
Brandy Nee
>thread-index: AcW25oiznmgpNZLpRfiouMYybMWQxg==
>X-WBNR-Posting-Host: 69.14.191.6
>From: "=?Utf-8?B?Umlja0FsbGVuUw==?=" <RickA...@discussions.microsoft.com>
>References: <00E4644A-7892-41ED...@microsoft.com>
<#8uZ5I4r...@TK2MSFTNGXA01.phx.gbl>
<C92E9B07-9099-478A...@microsoft.com>
<EFCXvHfs...@TK2MSFTNGXA01.phx.gbl>
>Subject: RE: DCOM Server Event ID 10003
>Date: Sun, 11 Sep 2005 08:36:10 -0700
>Lines: 164
>Message-ID: <AFDD80AD-4177-4DC5...@microsoft.com>
>MIME-Version: 1.0
>Content-Type: text/plain;
> charset="Utf-8"
>Content-Transfer-Encoding: 7bit
>X-Newsreader: Microsoft CDO for Windows 2000
>Content-Class: urn:content-classes:message
>Importance: normal
>Priority: normal
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
>Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGXA03.phx.gbl
>Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:152376
>X-Tomcat-NG: microsoft.public.windows.server.sbs
RickAllenS
what would be trying to open a Word document. Perhaps the exchange server is
trying to use Word's editing capabilities? My server doesn't get used a lot
so that many occurences of the error makes me think that somebody might be
playing around in there.
Yes, the instructions in your last post seem to have fixed the issue. I
think it was just a matter of finding the right place to adjust the
permissions.
Thanks for you r help!
Brandy Nee [MSFT]
Thank you for posting back!
I am glad to hear that the information answers your questions and thing is
working correctly on your side now. If you need any assistance regarding
SBS server in the future, please feel free to post back to this Great
Newsgroup. We are glad to be working with you again!
Best regards,
Brandy Nee
>thread-index: AcW3k+PmAZ8KrJ98QPOqebwKQqwrpA==
>X-WBNR-Posting-Host: 69.14.191.6
>From: "=?Utf-8?B?Umlja0FsbGVuUw==?=" <RickA...@discussions.microsoft.com>
>References: <00E4644A-7892-41ED...@microsoft.com>
<#8uZ5I4r...@TK2MSFTNGXA01.phx.gbl>
<C92E9B07-9099-478A...@microsoft.com>
<EFCXvHfs...@TK2MSFTNGXA01.phx.gbl>
<AFDD80AD-4177-4DC5...@microsoft.com>
<PUvrs4zt...@TK2MSFTNGXA01.phx.gbl>
>Subject: RE: DCOM Server Event ID 10003
>Date: Mon, 12 Sep 2005 05:17:06 -0700
>Lines: 290
>Message-ID: <A2FE1021-F9C2-4C03...@microsoft.com>
>MIME-Version: 1.0
>Content-Type: text/plain;
> charset="Utf-8"
>Content-Transfer-Encoding: 7bit
>X-Newsreader: Microsoft CDO for Windows 2000
>Content-Class: urn:content-classes:message
>Importance: normal
>Priority: normal
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
>Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGXA03.phx.gbl
>Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:152609
>X-Tomcat-NG: microsoft.public.windows.server.sbs
Kumar@discussions.microsoft.com Sanjay Kumar
I am getting same issue not able to resolve issue. Please advise me.
Regards,
Sanjay Kumar