Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 10005 Source: DCOM

Source
Level
Description
DCOM got error "<error description>" in order to run the server: {COM object GUID}
Comments
 
Error 193 - In many cases, this is caused by the presence of a file or folder called C:\Program. Removing or renaming this will fix the problem.
GUID: A1F4E726-8CF1-11D1-BF92-0060081ED811 - This GUID belongs to the Windows Image Acquisition (WIA) service and the event was recorded on a server where this services was disabled. A Remote Desktop session was opened when a camera was connected to the client computer, triggering an attempt from the server to use the default action of importing pictures from the camera.
Service StiSvc - We are getting this error message when we connect to a remote server using Terminal Services client. The client is trying to start the service on the remote server but the service does not exist. StiSvc is the Microsoft Still Image Service and it relates to digital cameras, scanners or another graphical input devices.
Error 1084, service EventSystem - This is a "normal" error as code 1084 means "This service cannot be started in Safe Mode" and EventSystem is a service that is not supposed to run when a computer is started in Safe Mode. The error should not be recorded for a normal boot. Other services might be reported with a similar error for this type of situation (Safe Mode).
Error: "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. Attempting to start the service "StiSvc" with arguments "" in order to run the server:{<GUID>}". In my case,   under Windows 2003, I installed Lexmark MFP and I had to start the service WIA "Windows Image Acquisition".


Error: "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. ", service: upnphost, server: {204810B9-73B2-11D4-BF42-00B0D0118B56}

In my case, this error began after I installed Windows Media Player 11. I had previously set these two services - SSDP Discovery Service & Universal Plug and Play Device Host - to Disabled.

From a support forum, "...when you open WMP11 it wants to start the Universal Plug and Play Device Host service, which itself depends on the SSDP Discovery Service. If either of those services is disabled you will get the DCOM error in the event log. To avoid the error log, set both those services to manual. It does this even if there are no Plug and play devices for WMP to detect."

With the event viewer open and the time of the error noted, I then started WMP11, closed it and returned to the viewer - a new DCOM entry had been logged. I then set both above-named services to Manual and restarted WMP11 then closed it - no DCOM error was logged - problem fixed.
To determine the service vendor follow these steps:

1. Using Regedit navigate to the following registry value
HKLM\System\CurrentControlSet\Services\service_name where service_name is the name of the service displaye din the event description.
2. In the right pane double-click ImagePath.
3. The Edit String dialog box is displayed. Leave this dialog box open. If Svchost.exe is displayed in the Value data box then under the service name navigate to the Parameters folder and then double-click ServiceDll.
4. Click Start and then click My Computer.
5. Using the information displayed in the Value data box of the Edit String dialog box navigate to the program.
6. Right-click the program name and then click Properties. The Properties dialog box for the program is displayed.
7. To determine who the vendor is for this service refer to the Version tab (you can also find the path to the executable file in this tool).
In my case, the error message was "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it." and I got it while attempting to start the  wuauserv (Windows Update) service.

So, if you have the SAME error for the SAME service, then this might be caused by the Automatic Updates Service being disabled or if the .dll files needed for Automatic Update need to be registered. Just run the following commands to register the .dll files and the service will also be set to automatic:

REGSVR32 %windir%\system32\wuapi.dll
REGSVR32 %windir%\system32\wuaueng1.dll
REGSVR32 %windir%\system32\wuaueng.dll
REGSVR32 %windir%\system32\wucltui.dll
REGSVR32 %windir%\system32\wups.dll
REGSVR32 %windir%\system32\Wuauserv.dll

However, if the Automatic Updates Service is disabled on purpose (i.e. through GPO or otherwise), then this error message can be ignored.
Error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it, Service COMSysApp - COM+ System Application was disabled in my case. If you will enable this service and start this issue will not occur again.
- Error: "The dependency service or group failed to start. " attempting to start the service upnphost with arguments "-" - Error was caused by UPNP service because I disabled the SSDP service and the UPNP service depends on it. Disabling UPNP service (or enabling SSDP service) also should fix the issue.
- Error: "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. " attempting to start the service CitrixWMIService with arguments "-Service" in order to run the server: <GUID>" - See the link to "Citrix Support Document ID: CTX117065".
- Error: "1297. attempting to start the service TermService with arguments "" in order to run the server: {<GUID>}" - See ME946399.
- Error: "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. attempting to start the service COMSysApp with arguments "" in order to run the server: (<GUID>)" - See ME917675.
- Error: "The service did not respond to the start or control request in a timely fashion. attempting to start the service NISUM with arguments "-Service" in order to run the server: {<GUID>}" - See the link to "Symantec Knowledge Base Document ID: 2003121714401248".
In our case, the NetMan service was failing to start on a Windows 2000 SP4 Server after replacing the Tape Drive with an identical one. Apparently, the firmware revision level was newer on the replacement and the Veritas Tape drivers were preventing the NetMan service from starting. We switched to Microsoft drivers and, after a reboot, the NetMan service started successfully.
In our case, this was related to a Veritas Tape Driver in a Windows 2000 Server. Please see article ME842696. We had set Veritas Backup Exec to use its internal tape driver for our Dell PowerVault 110T tape drive. We followed the instructions in the article above, rebooted, and all was well.


- Error "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. " attempting to start the service VSS with arguments "" in order to run the server: {<GUID>} - In my case, I just started the Volume Shadow Copy service that was disabled.
- Error: "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.  attempting to start the service ACCLUSTER with arguments "-Service" in order to run the server:{<GUID>}" - See ME310877 to fix this problem.

- Error: "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. " attempting to start the service IISADMIN with arguments "" in order to run the server: {<GUID>}" - See ME329269.

- Error: "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it." attempting to start the service helpsvc with arguments "" in order to run the server: {<GUID>}" - See ME841996.

- Error: "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. " attempting to start the service BITS with arguments "" in order to run the server: {<GUID>}" - See Background Intelligent Transfer Service for details on BITS.

- Error: "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. attempting to start the service ntmssvc with arguments "-Service" in order to run the server: {<GUID>}" - See the link to "Veritas Support Document ID: 262914".

- Error: "The service cannot be start, either because it is disabled or because it has no enabled devices associated with it. “attempting to start the service IISADMIN" - See "Citrix Support Document ID: CTX110791" for details.

- Error: "Logon failure: the user has not been granted the requested logon type at this computer. " and was unable to logon .\IWAM_servername in order to run the server: {<GUID>}" - See ME236007.

- Error: "An instance of the service is already running" - See "Veritas Support Document ID: 184796".

ME825750 provides information on how to disable DCOM support in Windows.

See ME896224 and MSW2KDB for more details on this issue.
- Error: "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. attempting to start the service upnphost with arguments" - The event occurred after disabling UPnPHost on Windows XP. Check with REGEDIT to re-enable this service.
System Key: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\upnphost].
Value Name: Start.
Data Type: REG_DWORD (DWORD Value).
Value Data: 3.
In one case, this problem was due to the IIS Admin Service being disabled.

- Error: This service cannot be started in Safe Mode" - This event is self-explanatory. The event can be ignored if it occurred when Windows 2000 was started in Active Directory Restore mode or some other form of Safe Mode.
- Error: "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. " attempting to start the service IISADMIN with arguments "" in order to run the server: {<GUID>}" - We found that we were getting this error on our SMS 2003 Management Point server after we had changed the management point service from another server to this one. During the change, the IIS Service was disabled on some, but not all of our SMS 2003 Distribution Point servers. There was a 10005 error on the effected Distribution Point server. Enabling and starting the IIS service on the Distribution Point server stopped the errors.
- Error: "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. " attempting to start the service StiSvc with arguments" - This error occurred after I disabled the Windows Image Acquisition service and then I started Paint Shop Pro. Restarting the Windows Image Acquisition service corrected this problem.
- Error: "The environment is incorrect. 58" - I started the "Windows Image Acquisition (WIA)" service and the error did not reappear.
I got this when disabling WMI. Unfortunately, I could not restart WMI because the DCOM was already started by something else, which turned-out to be the SQL server. I fixed it by:
1. Renaming sqlsrvr.exe.
2. Restarting server.
3. Starting WMI (and setting it to automatic).
4. Renaming sqlsrvr.exe.
In my case, the "System Event Notification" service was disabled. I enabled it and that fixed the problem.


If you are running Veritas NetBackup Data Center this can be an issue if the Removable Storage Management (RSM) service on Windows 2000 is disabled. If so DCOM should be disabled. Refer to Veritas TechNote ID: 240378 for more details.
- Error: "The system cannot find the file specified" - This happened to me on a WinXP Pro system. To fix it make sure that "dllhost.exe" file exists in "c:\windows\system32" folder. If it does not exist, copy it from another pc. Then go to Services in Administrative Tools and start the COM+ System Application services.
As per Microsoft: "These error messages are generated because another application, such as Microsoft Transaction Server, has already started the Dcom (the Distributed Component Object Model) Service. These messages do not indicate an actual problem and are benign." The recommended solution is to install the latest Service Pack

Error: "The Dependency Service does not exist or has been marked for deletion" Attempting to start the service IIS Admin with arguments " " in order to run the server: (a9e69610-b80d-11d0-b9b9-00a0c922e750) - This is the most common error for this event. There are several instances where this can occur:

The error can be genereated when the Protected Storage, RPC Configuration, or Windows NT LM Security Support Provider is not started, is not installed, or has become corrupt. See ME187710 and ME189649 for more details.

Another potential cause for this error is that the Windows NT LanManager (NTLM) Security Support Provider service is not installed. See ME218458 for more details.

Article ME249023 describes this error as showing up after the restart of Microsoft Internet Explorer for the second time during setup and the user logged in using an administrator account is different from the one used to start Internet Explorer Setup.

Error: "An instance of the service is already running." - This is a nonfatal error warning that the IIS service is already started but has not registered a class factory that a Distributed Component Object Model (DCOM) client requires. It should be resolved by the latest service pack. See ME193646.

Error: "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it." attempting to start the IISAdmin with arguments.". As per ME295623 the can be caused if the Microsoft Internet Information Services (IIS) Admin Service is disabled on the computer on which you are trying to install Exchange 2000 Server. Exchange 2000 Server requires the IIS 5.0 services to be running in order to install and function correctly.

Another article that mentions this error is ME300319 but this is in fact a failure of MOM (the Microsoft Operations Manager) to load the proper event message file.

Error: "The service did not respond to the start or control request in a timely fashion.", {BA126AD1-2166-11D1-B1D0-00805FC1270E} server - From a newsgroup post, this message start occuring after the installation of Zone Alarm personal firewall). The fix was to start the Zone Alarm after the WWW service (either by a startup script or by making Zone Alarm dependent on the WWW service).

Error: "The service database is locked". One may get this error if an attempt is made to stop/start or otherwise perform some service-related tasks when a server has just started and the systems still performs some of the startup functions in the background thus keeping the services database locked. In this case just wait a couple of minutes for the system to finish its tasks. It could also be that a faulty service installation procedure "locked" the database and in this case a reboot may help.
In windows 2000, you can get this error if you disable the WinMgmt service and you try to run computer management.  This will also cause computer management not to run. To fix, enable the service.
Error "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.". This error occurred on a Windows 2000 Server. I found that the com+ Event System Service had been stopped and disabled. Once this service was started and set to automatic, the error subsided.
Error: "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. " attempting to start the service ImapiService with arguments "-Service" - The event occurred after disabling "IMAPI CD-Burning com Service" on Windows XP. Re-enable the service to avoid the error.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...