Event ID 10006

hacori 3
Viewed 0

Hello

Since a recent server migration we get from one server on repeatedly (approx. after 15 minutes) the following error.

  • Event Time: 08 Apr 2021 11:23:29
  • Source: Microsoft-​Windows-​DistributedCOM
  • Event Log: System
  • Type: Fehler
  • Event ID: 10006
  • Event User: DOMAIN\​Administrator
  • Fehler "​2147944122"​ in DCOM wurde vom Computer "​[other-server]"​ empfangen, als versucht wurde, den folgenden Server zu aktivieren: {4CB43D7F-​7EEE-​4906-​8698-​60DA1C38F2FE}

I already searched in Google and followed every hint I could find but so far couldn't solve the issue yet. It seems that the server on which the PA server monitor satellite is running doesn't have needed priviledge on the other server to get requested data or fulfill a task. Both servers run with Microsoft Windows Server 2019 Standard. Before a recent migration the satellite ran on another server with Microsoft Windows Server 2008 R2 Standard. At that time there were no such events reported. The other server was already present but not actively used.

Where might be the cause? What is missing? Any suggestion is welcome.

Thanks

distributedcom event-log-monitor
2 Answers

Hi hacori —

4CB43D7F-7EEE-4906-8698-60DA1C38F2FE is the Windows Update component, and 2147944122, 800706BA in hex, is "RPC server unavailable".

So what is probably happening is the Inventory Collector (using the System Details piece) is trying to access the Windows Update component on the target server to query pending updates, but it is being blocked, probably by the firewall.

So you can remove the Inventory Collector monitor, or block it from using the System Details piece, or you could enable a rule in Windows Firewall (I suspect it is the Windows Remote Administration rule, though I'm not positive).

Thanks
Quinn

Please make sure to mark your questions accepted when you have your answer by clicking the gray checkmark to the left of the answer.

Quinn2713

Ok, thank you. I have now removed the inventory collector.

Initially, I didn't want to do that because this appears to me incomplete - just like covering a person's head to not see it's bleeding face instead of stopping the bleeding.

The Windows Firewall is turned off on both servers, so this cannot be the cause. It might have to do with the external (Hardware) firewall, but I didn't check that.

hacori3
Related