I've recently replaced a server and I'm now seeing complaints from
a DCOM process claiming that it cannot contact the old server using
any configured protocols and logging event ID 10009. This is being
logged on the internal SBS server (not the replacement machine).
Source is DCOM, category None, Event ID 10009, User is
NT Authority\System, message cut-n-pasted below;
DCOM was unable to communicate with the computer anubis using any of the
configured protocols.
I've had a go at finding and fixing this in the past which ultimately proved
unsuccessful, but did eliminate a few lurking references to the old server
name.
These events are occuring once per minute for serveral hours and then
stop for an seeminly abitrary period of time and then start again. (Of
course they usually stop a few minutes after I get a fraction of time to
look at the problem).
I used filemon from sysinternals, and the process that *appears*
to be related is emsmta.exe, access to emsmta is bracketting the
entry that looks to be writing the event log.
So Exchange is my most likely culprit, I've trawled through all the
configuration/property panels that I can think of and can find no
explicit reference to the old server name.
It's causing any operational issues (that I know of) but it is filling
the system event log and hence making spot real problems difficult.
So, does anyone know of any trying to trap this DCOM call to see
which process is invoking it ?
Regards,
Alan.