FIX: You cannot obtain detailed error information about DCOM 10009 errors in Windows Server 2003

When a DCOM error occurs, the error message does not contain sufficient information to determine the cause of the DCOM error. Instead, you may receive an error message that is similar to the following in Event Viewer: Note In this error message, ComputerName is a placeholder for the name of the computer that is unavailable.

No other information is available in the error log. To locate more information about the error that occurred, you must typically debug the application or analyze the network traffic.

A hotfix for this problem is now available from Microsoft. After you apply this hotfix, DCOM will log remote procedure call (RPC) extended error information in the event log to help determine the cause of the DCOM error.

Service pack information

To resolve this problem, obtain the latest service pack for Windows Server 2003. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Hotfix rollup package information

This problem is fixed in Microsoft Windows Server 2003 Post-Service Pack 1 COM+ 1.5 Hotfix Rollup Package 7. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Hotfix information

Prerequisites

You must have Windows Server 2003 installed to apply this hotfix.

Restart requirement

You must restart the computer after you modify the registry to enable this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

Registry information

You must modify the registry to enable this hotfix.

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

To enable this hotfix, follow these steps:

1. Click Start, click Run, type regedit, and then click OK.
2. Locate and then click the following registry key:
   HKEY_LOCAL_MACHINE\Software\Microsoft\Ole
3. On the Edit menu, click Add Value, and then add the following registry value.
   Collapse this tableExpand this table

   Value name	Data type	Value	Notes
   EnableEELogging	REG_DWORD	1	This registry value enables or disables logging in text format. This format is appropriate for manual analysis of the logs.
   LogEEInfoAsNative	REG_DWORD	1	This registry value enables or disables logging in Event Viewer. If you enable this kind of logging, you can use automated analysis to examine the extended error information.

4. Quit Registry Editor.

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

File information

Windows Server 2003, Itanium Architecture

Windows Server 2003 SP1, Itanium Architecture

Windows Server 2003 SP1, x64

Windows Server 2003, x86

Windows Server 2003 SP1, x86

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section. This problem was first corrected in Windows Server 2003 Service Pack 2.

The DCOM 10009 event contains insufficient data about the underlying error that caused them to occur. Usually, the DCOM 10009 events are logged because of network communications failures with the DCOM server. These include problems such as name resolution issues and firewall issues. These issues frequently lead to 0x6ba (0x800706ba) RPC errors. To gather additional error information about the underlying error with this fix in Windows Server 2003, enable RPC Extended Error information (EEINFO). When EEINFO is enabled, additional data is written to the DCOM 10009 event data section of the event. In Windows Vista, you do not have to turn on EEINFO because it is on by default and will be dumped in the DCOM 10009 event data by default. EEinfo will typically contain winsock specific errors like 10048 (WSAEADDRINUSE) such as when all available TCP ports are exhausted.

For more information about RPC Extended Error information, including how to enable and how to interpret the information, visit the following Microsoft Developer Network (MSDN) Web site: The following is an example of the event that is logged. It contains the additional useful data. In particular, the status, gencomp, and detloc information in the error data will be of interest. For example, the status 11001 is "No such host is known" and is generated by winsock (gencomp = 8).

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10009
Date: <Date>
Time: <Time>
User: N/A
Computer: <Server>
Description: DCOM was unable to communicate with the computer <Server>using any of the configured protocols.

For more information, see Help and Support Center at the following Microsoft Web site: The error that is mentioned in the "Symptoms" section is frequently a network communications error. The following are possible causes of this error:

• Name resolution errors are occurring.
• All TCP ports on the server are being used.
• TCP port collisions are occurring.

To troubleshoot DCOM 10009 errors, use the following methods.

Method 1: Verify that name resolution is working correctly

The activation page for a COM+ proxy application contains a Remote Server Name (RSN) property. The RSN property can be an IP address, a Fully Qualified Domain Name (FQDN), or a NetBIOS name. To troubleshoot this issue, use the ping command to test connectivity to the remote server by using the IP address, the FQDN, and the NetBIOS name.

Method 2: Verify TCP port usage

When a client makes DCOM calls to a COM+ server application, each connection may use a different TCP port. Therefore, all TCP ports on the server may be used. When this condition occurs, the server cannot accept additional connections.

For more information about how to determine TCP port usage when you troubleshoot TCP/IP connectivity issues, click the following article numbers to view the articles in the Microsoft Knowledge Base:

Method 3: Verify basic network connectivity to troubleshoot TCP collision issues

For more information about how use basic network troubleshooting to resolve TCP collision errors, click the following article number to view the article in the Microsoft Knowledge Base:

For more information about TCP port usage when a client makes a DCOM call to a COM+ server application, click the following article number to view the article in the Microsoft Knowledge Base: For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base: