Click here to get back home

Svchost, DCOM, WMI Issues after Updates

 HomeNewsGroups | Search | About
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
Svchost, DCOM, WMI Issues after Updates jwgoerlich 04-27-2007
Posted by jwgoerlich on April 27, 2007, 7:44 am
Please log in for more thread options
Hello group,

I am tracking an issue on several Windows 2003 servers. The timeframe
roughly correlates with this month's patch cycle. I have not nailed it
down to one particular update, however. Is anyone seeing a similar
problem?

The symptoms include:

1) Svchost.exe has an exception and stops. All of the services running
under it close. The services affected include:

Automatic Updates
Cryptographic Services
Distributed Link Tracking Client
Help and Support
Secondary Logon
Server
Task Scheduler
Windows Audio
Windows Firewall/Internet Connection Sharing (ICS)
Wireless Configuration
Workstation

None of the services fail and are restarted. They stop and remain
stopped until I bring them back online. The services do come back
online, so this is not related to KB910666.

2) WMI stops and is restarted around the same time. The Service
Control Manager (Event ID 7032) logs:

The Service Control Manager tried to take a corrective action (Restart
the service) after the unexpected termination of the Windows
Management Instrumentation service, but this action failed with the
following error: An instance of the service is already running.

3) There are three DCOM errors (Event ID 10010) also being logged.
These are:

The server did not register
with DCOM within the required timeout.
The server did not register
with DCOM within the required timeout.
The server did not register
with DCOM within the required timeout.

Windows Management
EventSystem, EventSystemTier2
Network Connection Manager Class {BA126AD1-2166-11D1-
B1D0-00805FC1270E}

Anyone else seeing this?

J Wolfgang Goerlich


Posted by Terry Prindle on May 1, 2007, 3:14 pm
Please log in for more thread options
I am experiencing the same thing, were you able to figure it out?

"jwgoerlich@gmail.com" wrote:

> Hello group,
>
> I am tracking an issue on several Windows 2003 servers. The timeframe
> roughly correlates with this month's patch cycle. I have not nailed it
> down to one particular update, however. Is anyone seeing a similar
> problem?
>
> The symptoms include:
>
> 1) Svchost.exe has an exception and stops. All of the services running
> under it close. The services affected include:
>
> Automatic Updates
> Cryptographic Services
> Distributed Link Tracking Client
> Help and Support
> Secondary Logon
> Server
> Task Scheduler
> Windows Audio
> Windows Firewall/Internet Connection Sharing (ICS)
> Wireless Configuration
> Workstation
>
> None of the services fail and are restarted. They stop and remain
> stopped until I bring them back online. The services do come back
> online, so this is not related to KB910666.
>
> 2) WMI stops and is restarted around the same time. The Service
> Control Manager (Event ID 7032) logs:
>
> The Service Control Manager tried to take a corrective action (Restart
> the service) after the unexpected termination of the Windows
> Management Instrumentation service, but this action failed with the
> following error: An instance of the service is already running.
>
> 3) There are three DCOM errors (Event ID 10010) also being logged.
> These are:
>
> The server did not register
> with DCOM within the required timeout.
> The server did not register
> with DCOM within the required timeout.
> The server did not register
> with DCOM within the required timeout.
>
> Windows Management
> EventSystem, EventSystemTier2
> Network Connection Manager Class {BA126AD1-2166-11D1-
> B1D0-00805FC1270E}
>
> Anyone else seeing this?
>
> J Wolfgang Goerlich
>
>

Posted by jwgoerlich on May 2, 2007, 8:51 am
Please log in for more thread options
On May 1, 3:14 pm, Terry Prindle <tprindle> wrote:
> I am experiencing the same thing, were you able to figure it out?

I have not found a satisfactory answer on the cause. I do have a fix,
however. I downloaded the latest Windows Update Agent.

http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/WindowsUpdateAgent30-x86.exe

I then removed and cleared the existing installation. Then I
reinstalled.

Net Stop "Automatic Updates"
regsvr32 /u wuaueng.dll
%systemdrive%
CD %systemroot%
RD /Q /S SoftwareDistributio~
Ren SoftwareDistribution SoftwareDistributio~
WindowsUpdateAgent30-x86.exe /wuforce /quiet /norestart

After a reboot, the symptom cleared and the services stayed running.

Hope that helps,

J Wolfgang Goerlich



Similar ThreadsPosted
Svchost and server not responding January 27, 2006, 11:36 am
Problem with automatic updates September 21, 2006, 10:03 pm
Verify the Current Updates March 28, 2007, 8:58 am
Pushing non microsoft updates to users April 7, 2006, 11:27 am
Security Updates - Support Ending? May 23, 2006, 4:14 pm
When Microsoft Releases it's Updates for windows server 2003? April 10, 2008, 6:35 am
Do We Need DCOM Enabled? February 10, 2007, 10:18 pm
DCOM + IIS + user credential December 16, 2005, 5:00 am
DCOM security hole? December 19, 2005, 6:13 am
DCOM Communication problem on W2003 SP1 July 29, 2005, 11:10 am

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap