Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 10010 Source: DCOM

The server {<GUID of the component>} did not register with DCOM within the required timeout.
As per Microsoft: "The Component Object Model (COM) infrastructure tried to start the named server; however, the server did not reply within the required timeout period. There might be a deadlock, or the program might not have responded to the server initialization code within the timeout period of two minutes". See MSW2KDB for more details.

If the component GUID is: 3D14228D-FBE1-11D0-995D-00C04FD919C1, the event appears according to Microsoft when you try to browse Active Server Pages (ASP) pages. See ME327153 to fix this problem.

GUID: 520CCA63-51A5-11D3-9144-00104BA11C5E. From a newsgroup post: "I think my DCOM problem was caused by a combination of Windows Messenger and Outlook Express. I removed Windows Messenger and I have not seen the DCOM error".
The event can also occur when you complete a drive remapping during a Citrix MetaFrame 1.8 installation on a Microsoft Windows 2000 Terminal Server computer. See ME280719 for more information.

- GUID: {D61A27C6-8F53-11D0-BFA0-00A024151983} - See ME825118 for a hotfix.
- GUID: {FB7199AB-79BF-11D2-8D94-0000F875C541} - See ME325717.
- GUID: {B6EC1632-E61D-11D2-85EA-0000F87A5571} - See ME247962.
- GUID: {02D4B3F1-FD88-11D1-960D-00805FC79235} - See ME326306.
- GUID: {3D14228D-FBE1-11D0-995D-00C04FD919C1} - See ME309051.
- GUID: {A9E69610-B80D-11D0-B9B9-00A0C922E750} - See ME252638.
- GUID: {8BC3F05E-D86B-11D0-A075-00C04FB68820} - See ME839880.
- GUID: {590A29BA-CF7E-4034-82AB-CBBEF9BA844E} - See ME870694.
- GUID: {601ac3dc-786a-4eb0-bf40-ee3521e70bfb} - See ME873375.
- GUID: "Network Crawler" - See ME873375.
- GUID: {27B04BDE-684A-415B-9F6E-187EDD0BD419} - See "Veritas Support Document ID: 270419".
- GUID: {3D14228D-FBE1-11D0-995D-00C04FD919C1} - See the link to "Citrix Support Document ID: CTX104956".
- GUID: {200691B9-C444-4089-8C61-247621196B15} - See ME891330.
- GUID: {A9E69610-B80D-11D0-B9B9-00A0C922E750} - See ME903072.

If you experience problems with Outlook Express running very slow, take a look at ""(see the link below).

If you are having problems installing the Microsoft Systems Management Server (SMS) 2003 Advanced Client on a computer that has Microsoft Internet Information Services (IIS) installed, then read 884870 for a workaround on this problem.

Also check ME312074 and ME820461 for more details.

If you do not need DCOM you can disable it in the following way:
1. Set the EnableDCOM Value Name, a string (REG_SZ) data type, at HKEY_LOCAL_MACHINE\Software\Microsoft\OLE to N.
2.Shutdown and restart your computer.
3.For Windows XP and Windows Server 2003, complete the following additional steps:
  A. Run Dcomcnfg.exe.
  B. Expand Component Services.
  C. Right-click Computer and press Properties. For a remote computer, right-click Computer, press New, press Computer, type the ComputerName, right-click the ComputerName and press Properties.
  D. Select the Default Properties tab.
  E. Clear the Enable Distributed COM on this Computer box.
  F. press Apply to disable DCOM.
  G. Press OK and exit Dcomcnfg.exe.
  H. Shutdown and restart your computer.

Also check ME826382 to see how to disable DCOM support in RPC over HTTP for Win2k3 servers.
- GUID: {e60687f7-01a1-40aa-86ac-db1cbf673334} - Corresponds to SUS (Software Update Service). Typically, when this event is recorded, there are some problems starting the Windows Update Service. In many cases, in the Services applet, the Windows Update Service is either stuck in "Starting" mode or stopped. EV100649 (Windows Update service fails to start) provides suggestions on how to fix this by reinstalling the Windows Update client.
- GUID: {AB8902B4-09CA-B78D-A8F59079A8D5} - This particular GUID is related to POWELIKS’s malware (a trojan). See EV100605 (POWELIKS Levels Up With New Autostart Mechanism) for information on how to investigate an affected system and remove the malware.
GUID: 1B1F472E-3221-4826-97DB-2C2324D389AE and BF6C1E47-86EC-4194-9CE5-13C15DCB2001 - We determined that these GUIDs are associated with a Microsoft SkyDrive maintenance tasks configured to run at 3:00 am in Microsoft Task Scheduler on a Windows 8.1 Pro workstation. The task says: "Performs OneDrive file sync when the computer is idle." and it shows a failure with Error code 0x80080005. Most probably this issue occurs when there is no SkyDrive enabled account configured on the computer.
GUID: AB8902B4-09CA-4BB6-B78D-A8F59079A8D5 - From a support forum: "If this error didn’t occur previously, a quick solution is to run System Restore and get back to the previous good status. If System restore doesn’t help. Please also try the following:
1. Ensure all updates have been applied on the Windows 7 computer.
2. Run the following command in an elevated command prompt to check if there is any system file corrupted:

sfc /scannow

GUID: ED1D0FDF-4414-470A-A56D-CFB68623FC58 - Corresponds to Windows Media Player (wmplayer.exe). The event was recorded when a corrupted video file was double-clicked (and wmplayer tried to open it).
GUID: 73E709EA-5D93-4B2E-BBB0-99B7938DA9E4 - Microsoft WMI Provider Subsystem Host - This event was recorded when the computer restarted from "Sleep" mode.
I had a custer with Siebel components serving the generation of reports. My CLSID was {000209FF-0000-0000-C000-000000000046} which pointed exactly to Microsoft Word Application. I had to clean the temporary files from \\WINNT\Temp folder in order to resolve the timeout problem. It turns out this is a known issue with some versions of Siebel.
GUID AAC1009F-AB33-48F9-9A21-7F5B88426A2E - Related to Microsoft Terminal Services - See EV100183 for a discussion thread about this problem.
GUID AAC1009F-AB33-48F9-9A21-7F5B88426A2E - Related to Microsoft Terminal Services - See EV100183 for a discussion thread about this problem.

GUID 000209FF-0000-0000-C000-000000000046 - Related to Microsoft Word

GUID C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493 - One user reported that ME310353 helped solving it.
In my case the problem (SID {0006F020-0000-0000-C000-000000000046} ) occurred because we have installed Office 2000 and I upgraded only Outlook to version 2003 on all workstations.  Each time a user tried to send a document via mail directly in the other office programs (e. g. Excel: File -> Send to -> Mail (Attachment)) he got a message saying "Cannot start Microsoft Outlook. A program eerror occured. Quit Outlook and Mircrosoft Windows and then start again". This was caused by a wrong value in the registry which refers to the old Outlook 2000.ex. To fix it, simply change the value in the key :HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0006F020-0000-0000-C000-000000000046}\LocalServer32  to C:\PROGRA~1\MICROS~1\Office\ to C:\PROGRA~1\MICROS~1\Office11\.
- GUID: {D99E6E73-FC88-11D0-B498-00A0C90312F3} - See ME959117.
- GUID: {4FB6BB00-3347-11D0-B40A-00AA005FF586} - See ME912063 for a hotfix applicable to Microsoft Windows Server 2003.
- GUID: {F1673109-CF44-468D-9E23-FE4116F84CFA} - See ME870655.

Microsoft article ME909444 has some information about a situation in which this event occurs. Follow the link to the article for details.
- GUID: {8BC3F05E-D86B-11D0-A075-00C04FB68820} and {BA126AE5-2166-11D1-B1D0-00805FC1270E} - From a newsgroup post: "It appears that some MS patch changed the permissions on the "HKEY_CLASSES_ROOT\CLSID" registry key. In order to resolve the problem, the following permissions were added: Authenticated users: Read access; Network Service: Full control".
- GUID: {F3A614DC-ABE0-11D2-A441-00C04F795683} and {FB7199AB-79BF-11D2-8D94-0000F875C541} - The problem disappeared after unchecking the "Contacts" checkbox in Outlook Express (View->Layout), and then restarting Outlook Express. The "Contacts" checkbox may be selected again later without problems.

- GUID: {FBA44040-BD27-4A09-ACC8-C08B7C723DCD} - In my case, the Google toolbar was the culprit. I removed it and the problem was solved.
I was getting numerous events for various GUIDs on startup and at random times after startup on a Windows XP machine. The wide variety of GUIDs pointed to a problem with DCOM rather than the individual GUIDs. I traced the problem back to dodgy registry permissions. Article ME266118 on how to restore default NTFS permissions fixed the problem. The article refers to Windows 2000, but the solution worked well on Windows XP also.
- GUID: {5A5AA0AA-1DEB-4683-96B0-B43301E83971} - A newsgroup post suggests that this is related to the HPBPRO.EXE process which is the HP toolbox program. The way to solve this is to either remove the toolbox program or upgrade to version 1.048.0 or newer.
- GUID: {D3FB54B3-B359-4FE4-AE66-49FFBF799088} - See the link to "Citrix Support Document ID: CTX112168".
- GUID: {14B0E00C-96F8-4A61-814B-3F2DD512E1BF} - See the link to "Citrix Support Document ID: CTX112168".
- GUID: {4991D34B-80A1-4291-83B6-3328366B9097} - This event can occur when a large file is transferred from the Windows Update Server. A possible solution is to empty the contents of the "C:\Documents and Settings\All Users\Application Data\Microsoft\Network" folder.
- GUID: {ED081F25-6A77-4C89-B689-C6E15C582EC1} - In my case, this is related to Microsoft Active Sync, and only occures when the pda/phone is not in the cradle. It has never occured with the phone in the cradle, and can be duplicated by removing the phone. I am ignoring it.
GUID: {0C0A3666-30C9-11D0-8F20-00805F2CD064} – this GUID refers to MDM.EXE or “Machine Debug Manager”. This runs when “Disable Script Debugging” is cleared (i.e. script debugging is enabled) in Internet Options -> Advanced. Also runs with ASP scripts.
Incorrect configuration causes slow IE load, this event in the event log and EventID 37 from source W3SVC.

Fix1: As stated by “Anonymous (Last update 5/3/2005)”, delete this DCOM application (I do not know the implications of this deletion).
Fix2: Check the “Disable Script Debugging” checkbox in Internet Options -> Advanced.
Fix3: Enter Component Services (Windows XP) or use DCOMCNFG.EXE (Win2K) to configure the properties for “Machine Debug Manager”. Remove and then replace IWAM_<server> and IUSR_<server> accounts in the “Use custom access permissions” and “Use custom launch permissions” sections on the “Security” tab. Ensure “Allow Access” & “Allow Launch” permissions are set for these accounts.

Note: Possibly a side issue but the above got me so far. I still had script errors when running ASP scripts.
Fix: Re-register the scripting engine with the following command:
"regsvr32 c:\winnt\system32\scrrun.dll".
GUID: {BAA8FB92-D1E7-4181-B0EE-94DA3329F7C0} - This event was caused by Microsoft Handwriting recognition being installed. It happened on shutdown on Windows XP. Since I have no devices that recognize handwriting, I simply removed it through settings on the language toolbar. I followed the following procedure taken from Microsoft TechNet website for DCOM errors.

To determine the program vendor:
1. Using Regedit, navigate to the following registry value
HKCR\CLSID\CLSID value\localserver32.
The CLSID value is the information displayed in the message.
2. In the right pane, double-click Default. The Edit String dialog box is displayed. Leave this dialog box open.
3. Click Start, and then click My Computer.
4. Using the information displayed in the Value data box of the Edit String dialog box, navigate to the program.
5. Right-click the program name, and then click Properties. The Properties dialog box for the program is displayed.
6. To determine who the vendor is for this program, refer to the Version tab.
- GUID: {0C0A3666-30C9-11D0-8F20-00805F2CD064} - This GUID belongs to MDM i.e. Machine Debug Manager. This problem caused a severe slowdown when starting Internet Explorer or Outlook XP. Contributor Stephan Grossberndt already posted his solution to this problem. An alternative solution is to go to "c:\winnt\system32\com\comexp.msc” -> Component Services -> Computer -> My Computer -> DCOM config -> select Machine Debug Manager -> delete.

- GUID: {A1F4E726-8CF1-11D1-BF92-0060081ED811} - The problem I have encountered was that the Windows Media Encoder did not start and this event was logged in the event log. To resolve this issue, I had to stop and disable the WIA (Windows Image Acquisition) service.
We had this problem, every time a user logged on to the server, via terminal services. Originally, we got the EventID 10002 from source Dcom, but after using dcomconfg.exe to change permissions on the culprit (FameworkServices.exe, a McAfee service) to default on all 3 topics, the 10002 error disappeared, and the 10010 error appeared. To get rid of the 10010, all that was needed was a restart of the FrameworkService service.
- GUID: {2C5DFFB3-472F-11CE-A030-00AA00339A98} - This error was occurring on a SQL 2000 cluster member running on Win2k. I searched the registry and I found that the GUID belonged to the License Logging Service. I also had many “llsmgr.exe” processes running. I terminated all running “llsmgr.exe” processes and stopped the License Logging Service. The DCOM errors stopped appearing. This does not affect the operation of any software on the servers. See MS article ME824196 for more information.
From a newsgroup post: "By searching the registry for the "server" number listed in the error log, I found it in the registry. Inside the associated registry entries, I found a reference to wiamgr.dll. A search on this revealed that this is the new "Windows Image Acquisition" system, which is supposed to replace TWAIN, and is new in XP. However, that was not much help, since it only confirmed what I suspected before, that I had a scanner related problem. In the end, to fix the problem, I searched my system for all “.dll” files starting with “wia”. I found that there were around 7 or so sitting in “c:\windows\system32”. I did a “regsvr32 wiamgr.dll” and repeated that for all the DLLs starting with “wia”, then I followed it up with a “SFC /SCANNOW” and after a reboot, everything was fixed".
- GUID: {DFDCBFDA-632A-4DC1-93E4-55E7B50F6C64} - I have had many 10010 errors related to the NetIQ AppManager Agent. NetIQ Knowledge Base Article ID: NETIQKB26239 addresses this situation.
- GUID: {0C0A3666-30C9-11D0-8F20-00805F2CD064} - This GUID belongs to MDM i.e. Machine Debug Manager. This problem caused a severe slowdown when starting Internet Explorer or Outlook XP. I solved this by:
1. Disabling DCOM. Go to “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole” and set “EnableDCOM” to “N”. Another way to accomplish this is to run the following command “c:\winnt\system32\com\comexp.msc” -> Component Services -> Computer -> right click My Computer -> Options/Preferences -> Default Options/Preferences -> uncheck “Enable DCOM on this computer”.
2. Turning off Script Debugging in IE.
3. Reboot.
- GUID: {8BC3F05E-D86B-11D0-A075-00C04FB68820} - This GUID belongs to Windows Management Instrumentation Service. EventID 10010 was generated every 10 minutes. I restarted the service and the problem was solved.
- GUID: 6CE8FEE6-A771-11D3-9B08-0090275F67ED - Appears when you try to install Oracle 8 client on a server.
- GUID: {9B9A80E0-A9C0-11D2-B5E1-006008187232} - This error occurred on a Dell 4600 running Windows 200 Server and operating as a DNS Server and Domain Controller. When searching thru my server's registry, the GUID (Global Unique Identifier) referenced "VxVmCmd Command line Server". This references Dell's Array Manager. The problem is a timing issue between DCOM and Array Manager. The event error will occur only once upon boot. According to Dell support, it will hopefully be corrected when Array Manager 3.5 arrives. In the meantime, Dell support had me to search the registry for the GUID {9B9A80E0-A9C0-11D2-B5E1- 06008187232}. It should occur only twice. Delete the key for each instance. Reboot and Event 10010 is no more.

I looked in the registry for the GUID listed in the error, and found it was related to the Dell OMCI errors I was getting - which is basically Dells intrusion detection system telling me every 30 minutes that my pc case had been opened at some time. I just needed to go into the BIOS and reset or disable this.
In my case the GUID was: 4FB6BB00-3347-11D0-B40A-00AA005FF586 which is related to dmadmin, the Logical Disk Manager Administrative Service. As I found out it seams that it has moved to "manual start". Resetting it to "automatic" solved the problem.
In some cases at least, this error is profile-related. On a workstation that has several different users, I noticed the error was regularly absent when one user logged in but regularly present when another user logged in. Simply deleting the problem user's profile and recreating it didn't fix the error. I rebooted that workstation but didn't log in. From a different workstation I deleted the profile of the problem user and renamed the problem workstation's Default User profile to Default User.BAK. I copied the profile of the "clean" user and renamed it Default User. I logged into the problem workstation (as the problem user recreated the profile), and the error went away.
The component GUID {80EE4901-33A8-11D1-A213-0080C88593A5} belongs to the Diskeeper defragmentation program. Activating "Paging File Frag Guard" and "MFT Frag Guard" on all volumes makes this error disappear.
This problem showed up after enabling page heap through gflags.exe. The problem occurred every 60 seconds. After disabling this and rebooting, the error was no more.
If the GUID points to the Background Intelligent Transfer Service (Do a search in the registry for the GUID), it could be that the Network folder in %systemroot%\Documents and Settings\All Users\Application Data\Microsoft is missing. Create the folder then restart the service (net start bits).
In my case this was caused by the Instant Messaging component of Outlook XP. So I disabled using Tools, Options, uncheck Instant Messaging Support.
If you have an event like 7024 after this error, then it may be better to fix that first before dealing with event ID 10010. As a rule of thumb, look for events that provide you more information about the applications that generates the error.
GUID: {D61A27C6-8F53-11D0-BFA0-00A024151983} is a problem with Removable Storage. It means that some settings in DCOM for Removable Storage are not registered properly. I ran DCOMCNFG and the minute I ran it - it stated that it wanted to register two GUID's that were listed in DCOM but not the AppID section of the registry. When I said yes and rebooted, the error went away.

In my case this occured due to an HP Officejet printer, using driver version 2.43. Upgrading to new v 2.50 cured this.

As per Microsoft, if you receive this error in a Windows 2000 environment do the following to the users registry:
1. Start Registry Editor (Regedt32.exe).
2. Locate and then click the following key in the registry:
3. On the Edit menu, click Add Key, and then add the following registry value:
   Key name: MessengerService
4. Open the MessengerService Key:
5. On the Edit menu, click Add Value, and then add the following registry value:
   Value name: PrimaryService
   Data type: REG_SZ
   Value data: .NET Messenger Service
6. Quit Registry Editor.
Confirmed to work, however it would be required to do the same procedure for all present & future domain users (ok for admins)hopefully MS will have a permanent fix.
If the component GUID is: FB7199AB-79BF-11D2-8D94-0000F875C541 this is because the MSN/.net Messenger service cannot start. Check the following registry key for the user trying to log on:
Value: PrimaryService
Type: String
Data: ".NET Messenger Service" (without quotes). See ME325717 for more information.
On my machine, this error was reported by HPAiO Device, a component of the OfficeJet G85xi. This error occurs on fast machines with antivirus software running (I tested this with Sophos as well as Norton). A workaround (for Sophos) is to set all Sophos services to manual and, after the HP officeJet is loaded, start the services.
GUID AAB71939-CBFF-11D2-960F-000629F011E9. This error Identified an IBM subcomponent in the registry. But the real cause of the error was the Inetpub directory being moved from the default C:\ directory to D:\. When IIS was installed a new catalog was created in the Indexing Service labeled WEB. After the Inetpub directory move the catalog was still trying to index the directory in its original location. The fix is to go into Services and Applications under Computer Management. Locate the Indexing Service and delete the WEB entry under there. Then recreate the catalog by clicking on Indexing Service, select ACTION from the toolbar, choose NEW, CATALOG. Name it Web and point it to the new location for Inetpub. The DCOM entries will dissappear.
I had the same error in combination with the problem stated in the ME326607 and ME326460 ("Service-Specific Error code -2147944102" Error Message If You Try to Start the Background Intelligent Transfer Service (BITS) Service). Fixing the problem with BITS service fixes the problem with DCOM.
This error occured to me when GroupShield was automatically updating the virus definition files.  This msg came up every few seconds and users were blocked from accessing Exchange resources. This was resolved with a swift reboot to restart all the services.
The error occurred (on SBS2000) every 30 seconds. According to Microsoft the event occurs because those object classes are considered user globals by Dcom and Terminal Server. See ME187146.
if event IDs 4205 and 36 occur then the problem is that the identity for the com+ application or the Microsoft Transaction Server (MTS) package is configured for "Interactive user - the current logged on user". Because no user is currently logged on to the IIS console, the application cannot run. See ME282073
I encountered this when I tried to install Backup Exec Agent Accelerator when it already existed on the server.

I found another cause of this error. My GUID happened to be E0B8F398-BB08-4298-87F0-34502693902E.  This is a MS Instant Message object. I got this error when I opened Office XP Pro on a Windows XP Pro machine. OLXP would hang about 1 minute before it would open to the Inbox. The 10010 was generated everytime. This was caused by disabling IM via local policies in an attempt to prevent IM from running. (I personally do not like IM and it is annoying for it to ALWAYS pop-up on its own with no way to uninstall it). When OLXP is launched, it looks for IM for your contacts. Other events seem to spawn IM to launch even after you close it. I re-enabled IM from the policies and the Dcom is gone and OLXP opens as normal. I found ME290025 that addresses the OLXP/IM issue, but it doesn't reference the DCOM error. My issues was with OLXP with POP, not Exchange.
In my case, this event occurred when I restarted Windows 2000 Server after setting up a subweb with IIS 5.0 and deleting it from the wwwroot without using the Sharepoint Administrator Frontpage(2002) to delete the subweb. To fix the problemm, I re-created a subweb web with the identical name in Sharepoint Administration and deleted it with the Sharepoint Administrator. I was left with no folders in the wwwroot and no error message upon reboot.
I resolved this issue on a Windows 2000 Server serving Siebel Document Server. I found that the ID in my error message ({D45FD2FC-5C6E-11D1-9EC1-00C04FD7081F}) referenced the Microsoft Agent Server 2.0 which serves the Office Assistant. I knew to look in Dcom config, since the setup of Siebel Document required an edit of DCOM. Run dcomcnfg, double click Microsoft Agent Server 2.0, Edit "Use Custom Configuration Permissions" on the Security Tab, and add INTERACTIVE from the local machine with Full Control access. This made my errors go away.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.