none
DCOM got error "1385"

    Question

  • Hello,

    We have a very strange issue. We have one application (CtServer.exe) which has the dependency with Component Services (DCOM). But somehow, after server restart of monthly Windows patch update, CtServer.exe is not able to launch. Below is the error message in Event Viewer.

    DCOM got error "1385" and was unable to logon DomainName\UserName in order to run the server:
    {007FF070-C232-11D1-9CF6-00C04F95A801}

    Please note,

    • If I re-enter the same credential, and click OK, then application based on CtServer DCOM will be able to launch.
    • I believe there is no issue with the user account configured in the "Identity" tab in DCOM configurations. For example, correct username & password, no account lockout, no password expiration, etc.. I even changed the user account to a local user which is member of local Administrators group, but I'm facing the same issue.
    • I tried to use a automation script to restart the server (shutdown /r /f /t 0) once per 5min. It was repeated for thousands of times. But the issue was not reproduced (tasklist | find "CtServer.exe").
    • Monthly Windows patch update is not managed by our team, but the server administartor team. Currently we don't know how the server administrator team restarts servers for Windows patch update.

    Thanks,
    高麻雀

    Monday, May 20, 2019 9:05 AM

All replies

  • I would expect you to find other messages in the system/security/application event logs that would give you more information.  Check the security event log for the logon failure event. 
    Monday, May 20, 2019 11:49 AM
  • Hi,

    Thank you for posting in Microsoft TechNet Forum.

    This is typically triggered by their account having an Active Directory restriction applied to it, which means that the password expires after a certain number of days.

    Try to modify the Windows domain/AD account belonging to the user mentioned (DOMAIN\username), so that the password never expires.

    For more information, please refer to the following link:

    https://www-01.ibm.com/support/docview.wss?uid=swg21677911

    Note: This is a third-party link and we do not have any guarantees on this website. This is just for your convenience. And Microsoft does not make any guarantees about the content.

    If it doesn't work, try to uninstall the latest update patch and check.

    Best regards,

    Hurry


    Please remember to mark the reply as an answer if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com


    Tuesday, May 21, 2019 5:52 AM
  • Hi,

    Thank you for posting in Microsoft TechNet Forum.

    This is typically triggered by their account having an Active Directory restriction applied to it, which means that the password expires after a certain number of days.

    Try to modify the Windows domain/AD account belonging to the user mentioned (DOMAIN\username), so that the password never expires.

    For more information, please refer to the following link:

    https://www-01.ibm.com/support/docview.wss?uid=swg21677911

    Note: This is a third-party link and we do not have any guarantees on this website. This is just for your convenience. And Microsoft does not make any guarantees about the content.

    If it doesn't work, try to uninstall the latest update patch and check.

    Best regards,

    Hurry


    Please remember to mark the reply as an answer if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com


    Hi Hurry,

    Thanks for your reply. But I'm sorry it seems this is not helpful enough for me. I had already done Bing/Google and checked the search results (IBM support) before posting this thread here. Also,

    • If I re-enter the same credential, and click OK, then application based on CtServer DCOM will be able to launch.
    • I believe there is no issue with the user account configured in the "Identity" tab in DCOM configurations. For example, correct username & password, no account lockout, no password expiration, etc.. I even changed the user account to a local user which is member of local Administrators group, but I'm facing the same issue.

    In additional, may I know the reason why I need to try uninstalling patches? This will not be easy for us as patching is not managed by our team, but the server administrator team (a 3rd party partner). As far as I know, this issue only comes up once per month after server restart to apply Microsoft patch update. It seems it's not caused by some specific patch, but server restart! However, this issue somehow does not come up if using a automation script to restart the server (shutdown /r /f /t 0).

    Thanks,
    高麻雀

    Wednesday, May 22, 2019 7:57 AM
  • I would expect you to find other messages in the system/security/application event logs that would give you more information.  Check the security event log for the logon failure event. 

    Hi,

    Thanks for your reply. The security logs have been overwritten. I have extended the log size. But I will have to wait for one month to reproduce this issue because this issue seems only comes up once per month after server restart for Microsoft monthly patch update.

    Regards,
    高麻雀

    Wednesday, May 22, 2019 7:59 AM
  • Hi,

    Thank you for your feedback.

    Try to create a new user account and check. As mentioned, or you can wait to collect security log and make some analysises.

    Sincerely hope that your problem will be solved successfully.

    Best regards,

    Hurry


    Please remember to mark the reply as an answer if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    Thursday, May 23, 2019 1:12 PM