RE: Errors After Changing Administrator Password
- From: v-branee@xxxxxxxxxxxxxxxxxxxx ("Brandy Nee [MSFT]")
- Date: Fri, 13 Jan 2006 07:34:18 GMT
Hello Robert,
Thank you for posting to the SBS Newsgroup.
I understand that after change Administrator Account, you found Event IDs
10004 and 529 on the SBS 2K3 Server. If I have misunderstood your concern,
please let me know.
Based on my experience, this issue is complicated, and we need time to
troubleshoot. Please take your time to read through all my reply, try the
suggestions and gather the information for further research:
=======
Suggestion:
The Event 10004 should indicate a class ID for the component and you can
find the class ID referring to a component in
HKEY_CLASSES_ROOT\CLSID\B2B30542-D976-11D3-B188-0040056AC398}.
Please check it from the registry of this problem machine:
Start > Run > Regedit. Navigate to HKEY_CLASSES_ROOT\CLSID\.
When you locate the
HKEY_CLASSES_ROOT\CLSID\B2B30542-D976-11D3-B188-0040056AC398, check the
subkey InprocServer32 to find the dll file and check the registry key to
find any related information for this component. Based on these
information, we can determine what software includes this component. I did
not find this class ID in our database. Therefore, I think it is a third
party program. If you find the program, you may uninstall it and contact
the manufacturer to check it.
You also can export the registry key to me:
1. Find the node with the same name {B2B30542-D976-11D3-B188-0040056AC398}.
2. Choose the {B2B30542-D976-11D3-B188-0040056AC398} node.
3. Click from menu File > Export Registry.
4. Export this node to a .txt file (NOT the .reg file) on your desktop, and
send it to me.
You may also check this COM object in the DCOMCNFG.
=============
If the issue persists, please help me to gather following information for
further research:
a. How did you change the Domain Administrator account? Please fully list
your steps.
b. Can you use the Administrator account to log in SBS Server?
c. Is BRADFORDDC01 the SBS Server?
d. Did you use the changed password Administrator account to do following
performance on the Server:
"Opening Administrative Tools...Component Services...Computers...My
Computer...DCOM Config."
e. You mentioned "prompted with a few alert boxes". I strongly suggest that
you capture screen shots for each of the alert boxes and send them to my
mailbox so we can better understand your issue.
f. I also found following KB articles for you. If you have the exact same
issue as described inside, please apply the steps and see how it goes.
312497 PRB: COM+ Application Under Domain Account Fails Intermittently
http://support.microsoft.com/default.aspx?scid=kb;EN-US;312497
PRB: Cannot Expand "My Computer" in Component Services MMC Snap-In
http://support.microsoft.com/?id=301919
Please take your time to perform the steps, and gather the information. I
am looking forward to hearing from you!
Best regards,
Brandy Nee
Microsoft CSS Online Newsgroup Support
Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.
Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.
For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.
Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
>From: "Robert Zahm" <robzahm@xxxxxxxxxxx>
>Subject: Errors After Changing Administrator Password
>Date: Thu, 12 Jan 2006 09:04:16 -0600
>Lines: 74
>X-Priority: 3
>X-MSMail-Priority: Normal
>X-Newsreader: Microsoft Outlook Express 6.00.2900.2670
>X-RFC2646: Format=Flowed; Original
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670
>Message-ID: <uh$J2l4FGHA.2064@xxxxxxxxxxxxxxxxxxxx>
>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: 64-45-168-10.static.cypresscom.net 64.45.168.10
>Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP09.phx.gbl
>Xref: TK2MSFTNGXA02.phx.gbl microsoft.public.windows.server.sbs:236086
>X-Tomcat-NG: microsoft.public.windows.server.sbs
>
>We had to change our domain administrator password, and it (obviously)
>caused a few things to break. I have been able to resolve most of them,
but
>was looking for some verification on this problem in particular.
>
>I noticed the following in the event logs this morning, each logged about
>once per second:
>
>System Log:
>Event Type: Error
>Event Source: DCOM
>Event Category: None
>Event ID: 10004
>Date: 1/12/2006
>Time: 2:00:36 AM
>User: N/A
>Computer: BRADFORDDC01
>Description:
>DCOM got error "Logon failure: unknown user name or bad password. " and
was
>unable to logon BRADFORDREALES\ADMINISTRATOR in order to run the server:
>{B2B30542-D976-11D3-B188-0040056AC398}
>
>Security Log:
>Event Type: Failure Audit
>Event Source: Security
>Event Category: Logon/Logoff
>Event ID: 529
>Date: 1/12/2006
>Time: 2:00:29 AM
>User: NT AUTHORITY\SYSTEM
>Computer: BRADFORDDC01
>Description:
>Logon Failure:
> Reason: Unknown user name or bad password
> User Name: ADMINISTRATOR
> Domain: BRADFORDREALES
> Logon Type: 4
> Logon Process: DCOMSCM
> Authentication Package: Negotiate
> Workstation Name: BRADFORDDC01
> Caller User Name: BRADFORDDC01$
> Caller Domain: BRADFORDREALES
> Caller Logon ID: (0x0,0x3E7)
> Caller Process ID: 828
> Transited Services: -
> Source Network Address: -
> Source Port: -
>
>
>Using eventid.net, I believe that I was able to find the offending account
>information by doing the following:
>Opening Administrative Tools...Component Services...Computers...My
>Computer...DCOM Config.
>
>At this point, I was prompted with a few alert boxes: DCOM Configuration
>Warning! The CLSID {...} item, ... and title PccFrameWindow Class has the
>named value AppID, but is not recorded under \\HKEY_CLASSES_ROOT\AppId.
Do
>you wish to record it? I chose no for this and another popup for a
>different application (I believe these are related to the accounting
>software).
>
>Once in DCOM Config, I looked for the application ID referenced in the
>email, and found it for the application "BDmTk." Sure enough, when I went
>into the Properties...Identity tab, it was set to run as the
Administrator,
>with a place to enter the password.
>
>So my question is, is it safe to update this password? My gut says that
it
>is, but I'm not familiar with DCOM Config at all, so I am looking for some
>validation before I plow forward.
>
>Thanks,
>
>Rob
>
>
>
.
- Follow-Ups:
- Re: Errors After Changing Administrator Password
- From: Robert Zahm
- Re: Errors After Changing Administrator Password
- References:
- Errors After Changing Administrator Password
- From: Robert Zahm
- Errors After Changing Administrator Password
- Prev by Date: Re: Tool Question
- Next by Date: RE: Kerberos Error?
- Previous by thread: Errors After Changing Administrator Password
- Next by thread: Re: Errors After Changing Administrator Password
- Index(es):
Relevant Pages
|
