RE: Sysprep'd image, event 10020

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance


"David" wrote:

> 
> 
> "David" wrote:
> 
> > 
> > 
> > "Joe" wrote:
> > 
> > > I setup a machine, and included IIS.  Then Sysprep'd.  All machines brought 
> > > to life with this image are logging the following error in the event log.
> > > 
> > > I assume this has something to do with the machines being renamed during the 
> > > imaging process?  Any fix for this?  is this "bad"?
> > > 
> > 
> > > Thanks,
> > > 
> > > Joe
> > > 
> > > 
> > > Event Type: Error
> > > Event Source: DCOM
> > > Event Category: None
> > > Event ID: 10020
> > > Date:  26-Jan-06
> > > Time:  10:14:45
> > > User:  N/A
> > > Computer: ZATHRAS
> > > Description:
> > > The machine wide Default Launch and Activation security descriptor is 
> > > invalid. It contains Access Control Entries with permissions that are 
> > > invalid. The requested action was therefore not performed. This security 
> > > permission can be corrected using the Component Services administrative 
> > > tool.
> > > 
> > > For more information, see Help and Support Center at 
> > > http://go.microsoft.com/fwlink/events.asp.
> > > 
> > > 
> > > 
> > 
> > Joe - I've had a post on this for at least 6 month - no resposes at all - 
> > especially from Microsoft people.
> > 
> > The problem seems to be the IWAM account.  I can manually fix it by the 
> > following steps:
> > start -> Settings -> Control Panel -> Administrative Tools -> Component 
> > Services -> Component Services -> Computers -> My Computer
> > 
> > Right click My Computer -> Properties -> Com Security tab -> Launch and 
> > Activation Permissions -> Edit Default -> remove "Launch IIS Process Account" 
> > -> add IWAM_... account
> > 
> > I'm trying te see if there is a way to programmatically change the account 
> > entry in dcom.
> > 
> > Interestingly though is that on a clean installation (no sysprep use) with 
> > IIS there is no IWAM_ ... account listed.  So this may just be a wild goose 
> > chase.
> > 
> > Have you had any luck?  Have you found that this causes any problems?
> > 
> > I'm at a Computer Science school and the image will be used in teaching labs 
> > so I would like to know it works properly.
> > 
> > 
> 
> One other thing I just noticed is that in addition to the IWAM_... account, 
> the IUSR_ ... account has also been added by the sysprep process.
> 
> Again - I have no idea if either of these two accounts is needed but as they 
> weren't before using sysprep, I assume that they are not needed.

Sorry for the patchiness of my additions :-)

One other test I've tried is removing the IWAM and IUSR accounts with the 
comexp.msc under "Launch and Activation Permissions".  I rebooted and they 
were still gone.  I then sysprepped the system, imaged it and loaded the new 
image.  The two accounts had been added again.
.

Relevant Pages

  • Re: Sysprepd image, event 10020
    ... Then it does sound like its sysprep that adds it (or maybe the whole SID ... It contains Access Control Entries with permissions that are ... The problem seems to be the IWAM account. ...
    (microsoft.public.windowsxp.setup_deployment)
  • RE: Sysprepd image, event 10020
    ... > "Joe" wrote: ... and included IIS. ... > The problem seems to be the IWAM account. ... account has also been added by the sysprep process. ...
    (microsoft.public.windowsxp.setup_deployment)
  • Re: Framework v1.1 & LogonUser workaround
    ... Joe, thanks for the info it does help, mostly to let me know I'm on the right track. ... account call LogonUser, as that is the only account by default with the ... the WindowsIdentity constructor that creates a new WindowsIdentity from ... ASP.NET and IIS let you ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Sysprep and User account settings
    ... I created a base image and using the Shared Computer toolkit created a generic user account with proper restrictions placed on that account. ... So when I tried to use sysprep to create an image I can rollout, ... ANy ideas as to what happened to the settings applied to the generic account? ... If it's all the same hardware bin sysprep, just ghost away and all will be well, sysprep is excellent for "one image fits all hardware" but a complete waste of time if all platforms are the same. ...
    (microsoft.public.windowsxp.setup_deployment)
  • Re: sysprep overwrites custom account
    ... It could be that you are experiencing the change in sysprep for SP2. ... > 2) I created an account (student) with limited permissions using Shared ... > moving it to Deafult User, ...
    (microsoft.public.windowsxp.setup_deployment)