Tuesday, September 22, 2015

Server getting hammered with DistributedCOM CLSID {ECABAFB9-7F19-11D2-978E-0000F8757E2A} events

In case you have a system getting flooded with event 10014 DistrubutedCom events with this message:

The activation for CLSID {ECABAFB9-7F19-11D2-978E-0000F8757E2A} failed because remote activations for COM+ are disabled. To enable this functionality use Server Manager to install the COM+ Network Access feature in the Application Server role.

It may be caused by a remote machine trying to access the system using dcomcnfg. This event is complaining that windows feature "AS-Ent-Services" is not installed.

If this is the case, you will see RPC connections between this machine and the machine running the dcomcnfg. The remote machine will also be getting flooded by events that mention they are coming from the targeted machine.

No comments:

Post a Comment