none
DCOM got error "1385" RRS feed

  • Question

  • Hello,

    We have a very strange issue. We have one application (CtServer.exe) which has the dependency with Component Services (DCOM). But somehow, after server restart of monthly Windows patch update, CtServer.exe is not able to launch. Below is the error message in Event Viewer.

    DCOM got error "1385" and was unable to logon DomainName\UserName in order to run the server:
    {007FF070-C232-11D1-9CF6-00C04F95A801}

    Please note,

    • If I re-enter the same credential, and click OK, then application based on CtServer DCOM will be able to launch.
    • I believe there is no issue with the user account configured in the "Identity" tab in DCOM configurations. For example, correct username & password, no account lockout, no password expiration, etc.. I even changed the user account to a local user which is member of local Administrators group, but I'm facing the same issue.
    • I tried to use a automation script to restart the server (shutdown /r /f /t 0) once per 5min. It was repeated for thousands of times. But the issue was not reproduced (tasklist | find "CtServer.exe").
    • Monthly Windows patch update is not managed by our team, but the server administartor team. Currently we don't know how the server administrator team restarts servers for Windows patch update.

    Thanks,
    高麻雀

    Monday, May 20, 2019 9:05 AM

All replies

  • I would expect you to find other messages in the system/security/application event logs that would give you more information.  Check the security event log for the logon failure event. 
    Monday, May 20, 2019 11:49 AM
  • Hi,

    Thank you for posting in Microsoft TechNet Forum.

    This is typically triggered by their account having an Active Directory restriction applied to it, which means that the password expires after a certain number of days.

    Try to modify the Windows domain/AD account belonging to the user mentioned (DOMAIN\username), so that the password never expires.

    For more information, please refer to the following link:

    https://www-01.ibm.com/support/docview.wss?uid=swg21677911

    Note: This is a third-party link and we do not have any guarantees on this website. This is just for your convenience. And Microsoft does not make any guarantees about the content.

    If it doesn't work, try to uninstall the latest update patch and check.

    Best regards,

    Hurry


    Please remember to mark the reply as an answer if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com


    Tuesday, May 21, 2019 5:52 AM
  • Hi,

    Thank you for posting in Microsoft TechNet Forum.

    This is typically triggered by their account having an Active Directory restriction applied to it, which means that the password expires after a certain number of days.

    Try to modify the Windows domain/AD account belonging to the user mentioned (DOMAIN\username), so that the password never expires.

    For more information, please refer to the following link:

    https://www-01.ibm.com/support/docview.wss?uid=swg21677911

    Note: This is a third-party link and we do not have any guarantees on this website. This is just for your convenience. And Microsoft does not make any guarantees about the content.

    If it doesn't work, try to uninstall the latest update patch and check.

    Best regards,

    Hurry


    Please remember to mark the reply as an answer if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com


    Hi Hurry,

    Thanks for your reply. But I'm sorry it seems this is not helpful enough for me. I had already done Bing/Google and checked the search results (IBM support) before posting this thread here. Also,

    • If I re-enter the same credential, and click OK, then application based on CtServer DCOM will be able to launch.
    • I believe there is no issue with the user account configured in the "Identity" tab in DCOM configurations. For example, correct username & password, no account lockout, no password expiration, etc.. I even changed the user account to a local user which is member of local Administrators group, but I'm facing the same issue.

    In additional, may I know the reason why I need to try uninstalling patches? This will not be easy for us as patching is not managed by our team, but the server administrator team (a 3rd party partner). As far as I know, this issue only comes up once per month after server restart to apply Microsoft patch update. It seems it's not caused by some specific patch, but server restart! However, this issue somehow does not come up if using a automation script to restart the server (shutdown /r /f /t 0).

    Thanks,
    高麻雀

    Wednesday, May 22, 2019 7:57 AM
  • I would expect you to find other messages in the system/security/application event logs that would give you more information.  Check the security event log for the logon failure event. 

    Hi,

    Thanks for your reply. The security logs have been overwritten. I have extended the log size. But I will have to wait for one month to reproduce this issue because this issue seems only comes up once per month after server restart for Microsoft monthly patch update.

    Regards,
    高麻雀

    Wednesday, May 22, 2019 7:59 AM
  • Hi,

    Thank you for your feedback.

    Try to create a new user account and check. As mentioned, or you can wait to collect security log and make some analysises.

    Sincerely hope that your problem will be solved successfully.

    Best regards,

    Hurry


    Please remember to mark the reply as an answer if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    Thursday, May 23, 2019 1:12 PM
  • Hi,

    We have the same issue, but we need to re-enter the password daily and not only after a server restart.

    Has anyone been able to resolve this problem, or could anyone confirm that after creating a new account the problem was sorted?

    Thanks,

    GJ

    Tuesday, August 13, 2019 12:29 PM
  • Hi,

    Same situation here. Sometimes I need to re-enter the password more than once a day.

    I tried to create a new account and also use other Domain accounts. So far, I have failed miserably.

    I am using Windows 2016 STD.

    Thanks.
    Tuesday, August 13, 2019 6:18 PM
  • See if you can find this event (or any other COM+ event) in the Security eventlog. Other than when you intentionally reset the password. 

    Log Name:      Security
    Source:        Microsoft-Windows-Security-Auditing
    Date:          8/13/2019 3:40:37 PM
    Event ID:      5888
    Task Category: System Integrity
    Level:         Information
    Keywords:      Audit Success
    User:          N/A
    Computer:      TEST10B
    Description:
    An object in the COM+ Catalog was modified.
    Subject:
     Security ID:  TEST10B\Admin
     Account Name:  Admin
     Account Domain:  TEST10B
     Logon ID:  0x5D119
    Object:
     COM+ Catalog Collection: Applications
     Object Name:   
      ID = {B7E8F87F-DC9B-4354-A962-F53FE3D0C6DB}
      AppPartitionID = {41E90F3E-56C1-4633-81C3-6E8BAC8BDD70}
     Object Properties Modified: 
      Password = '********' -> '********'

    Tuesday, August 13, 2019 7:45 PM
  • Hi,
    There are only logs of the times I enter the password myself.

    When I try to access the service, this log is generated:

    Wednesday, August 14, 2019 12:19 PM
  • Can you log on to the server (RDP) with that account?

    https://social.technet.microsoft.com/forums/windowsserver/en-US/81b4d112-109f-40ad-8efa-2477cdc7ff2e/cluster-account-denied-logon-on-host-event-4625

    "We had a similar problem with Event ID 4625: Status 0xc000015b, Substatus 0x0 concerning our exchange 2010 server. The account on our domain was able to log in to everything except Outlook and OWA, and after hours of searching for solutions, we attempted to log in locally in the exchange server itself. Lo and behold, it connected, and we were able to connect remotely after that." 

    Wednesday, August 14, 2019 5:33 PM
  • Yes, I can login.
    The problem occurs with other accounts as well.
    Wednesday, August 14, 2019 6:32 PM
  • Does the problem also happen on your test servers or other servers with the same OS level? 

    Thursday, August 15, 2019 7:38 PM
  • This application was migrated from a Windows 2003, where this problem did not happen.
    I also reinstalled Windows (2016) from the current VM, to make sure it wasn't a problem with the system.

    This error occurs when I try to start the application from Component Services MMC:



    Thursday, August 15, 2019 7:57 PM
  • https://blogs.msdn.microsoft.com/dsnotes/2014/09/25/com-client-failing-with-error-8000401a/

    There must be something wrong with the account. There should be a COM+ error in the security or system event logs. Do you see any?

    On the Win2003 system, what groups is that account a member of? Is the account in the same groups on the 2016 server? Run secpol.msc on both systems and check the user rights assignments. See if there is a difference. 


    Thursday, August 15, 2019 11:39 PM
  • Any solution for this annoying issue? We need to re-enter the password several times a day and restart batch processes that are using DCOM.

    Thx, Marco

    Thursday, September 5, 2019 11:49 AM