Frequent DCOM 10004 / W3SVC 36 Errors

Hi guys,

I'm having issues with almost all of the IIS servers on our LAN; these
are Citirx and other web app servers used by our internal users.

The error is simple, users broswe the the web page for the web app /
Citrix server and are greeted with an IIS error page. The SYSTEM event
log is full of DCOM 1004 errors:

DCOM got error "Overlapped I/O operation is in progress. " and was
unable to logon .\IWAM_SERVER1 in order to run the server:
{3D14228D-FBE1-11D0-995D-00C04FD919C1}

And W3SVC erros:

The server failed to load application '/LM/W3SVC/1/Root/username'.
The error was 'The server process could not be started because the
configured identity is incorrect. Check the username and password.
'.
For additional information specific to this message please visit the
Microsoft Online Support site located at: http://www.microsoft.com/contentredirect.asp.

Running synciwam.vbs fixes this error everythime, but I don't
understand why I'm running this on a more-than daily basis. What could
be causing these errors to come up so frequently?

Thanks in advance,

-Chris

Re: Frequent DCOM 10004 / W3SVC 36 Errors

Hi,

For whatever reason it appears that the password stored in the SAM, and the
password IIS has for the IWAM account are getting "out of sync" every day.

So, I would start by auditing what might be affecting either of those two
things.

a) You can enable metabase auditing to detect changes to the IIS metabase.
See:
http://www.adopenstatic.com/faq/IISMetabaseAuditing.aspx

b) You can edit the local security policy of the server to audit Account
Management events (you may also wish to audit account logons as well), so
see if the change is being made there instead (Start -> Run -> secpol.msc)

Cheers
Ken

--
My IIS Blog: www.adOpenStatic.com/cs/blogs/ken



"cbtg2006" wrote in message
news:1185183182.776516.104380@o61g2000hsh.googlegroups.com.. .
> Hi guys,
>
> I'm having issues with almost all of the IIS servers on our LAN; these
> are Citirx and other web app servers used by our internal users.
>
> The error is simple, users broswe the the web page for the web app /
> Citrix server and are greeted with an IIS error page. The SYSTEM event
> log is full of DCOM 1004 errors:
>
> DCOM got error "Overlapped I/O operation is in progress. " and was
> unable to logon .\IWAM_SERVER1 in order to run the server:
> {3D14228D-FBE1-11D0-995D-00C04FD919C1}
>
> And W3SVC erros:
>
> The server failed to load application '/LM/W3SVC/1/Root/username'.
> The error was 'The server process could not be started because the
> configured identity is incorrect. Check the username and password.
> '.
> For additional information specific to this message please visit the
> Microsoft Online Support site located at:
> http://www.microsoft.com/contentredirect.asp.
>
> Running synciwam.vbs fixes this error everythime, but I don't
> understand why I'm running this on a more-than daily basis. What could
> be causing these errors to come up so frequently?
>
> Thanks in advance,
>
> -Chris
>