Re: Sysprep'd image, event 10020

Then it does sound like its sysprep that adds it (or maybe the whole SID
generation process causes COM+ to do it?).

I dunno either.

I suggest you repost this info over in component_svcs. There seems to be at
least one person there that handles this kind of stuff.

Joe


"David" <David@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:25A1FAE7-B9E8-41D1-8E6C-6843DAC8807C@xxxxxxxxxxxxxxxx


"David" wrote:



"David" wrote:



"Joe" wrote:

I setup a machine, and included IIS. Then Sysprep'd. All machines
brought
to life with this image are logging the following error in the event
log.

I assume this has something to do with the machines being renamed
during the
imaging process? Any fix for this? is this "bad"?


Thanks,

Joe


Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10020
Date: 26-Jan-06
Time: 10:14:45
User: N/A
Computer: ZATHRAS
Description:
The machine wide Default Launch and Activation security descriptor is
invalid. It contains Access Control Entries with permissions that are
invalid. The requested action was therefore not performed. This
security
permission can be corrected using the Component Services
administrative
tool.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.




Joe - I've had a post on this for at least 6 month - no resposes at
all -
especially from Microsoft people.

The problem seems to be the IWAM account. I can manually fix it by the
following steps:
start -> Settings -> Control Panel -> Administrative Tools -> Component
Services -> Component Services -> Computers -> My Computer

Right click My Computer -> Properties -> Com Security tab -> Launch and
Activation Permissions -> Edit Default -> remove "Launch IIS Process
Account"
-> add IWAM_... account

I'm trying te see if there is a way to programmatically change the
account
entry in dcom.

Interestingly though is that on a clean installation (no sysprep use)
with
IIS there is no IWAM_ ... account listed. So this may just be a wild
goose
chase.

Have you had any luck? Have you found that this causes any problems?

I'm at a Computer Science school and the image will be used in teaching
labs
so I would like to know it works properly.



One other thing I just noticed is that in addition to the IWAM_...
account,
the IUSR_ ... account has also been added by the sysprep process.

Again - I have no idea if either of these two accounts is needed but as
they
weren't before using sysprep, I assume that they are not needed.

Sorry for the patchiness of my additions :-)

One other test I've tried is removing the IWAM and IUSR accounts with the
comexp.msc under "Launch and Activation Permissions". I rebooted and they
were still gone. I then sysprepped the system, imaged it and loaded the
new
image. The two accounts had been added again.


.

Relevant Pages

  • Re: One works the other doesnt
    ... it say anything about permissions that when I open the .mdb in Access, ... but the user account under which IIS is running does not. ... the IWAM account is being used. ...
    (microsoft.public.inetserver.asp.db)
  • Re: Sysprepd image, event 10020
    ... invalid. ... It contains Access Control Entries with permissions that are ... The problem seems to be the IWAM account. ...
    (microsoft.public.windowsxp.setup_deployment)
  • Re: Event Viewer entry
    ... Fascinating - I had spotted the IWAM post and deleted the account, ... Activation Permissions, clicked Edit Default, removed the IWAM account ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: IWAM user
    ... Where IWAM should be in use depends on two things, ... what isolation level your web is set to use (IWAM is used ... impersonate the browser logged in account). ... > testing server and recently I've been having some permissions issues. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Sysprep and User account settings
    ... I created a base image and using the Shared Computer toolkit created a generic user account with proper restrictions placed on that account. ... So when I tried to use sysprep to create an image I can rollout, ... ANy ideas as to what happened to the settings applied to the generic account? ... If it's all the same hardware bin sysprep, just ghost away and all will be well, sysprep is excellent for "one image fits all hardware" but a complete waste of time if all platforms are the same. ...
    (microsoft.public.windowsxp.setup_deployment)
Loading