Event ID 10006 on notebook in network and user logged on other wkstns

[gbl]

We are running a Windows server 2003 network with Windows 2000 pro and XP Pro sp1/sp2 clients. One notebook with XP Pro sp1 gets a continuous stream of event id 10006 in the system log, similar to:

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10006
Date: 12/22/2004
Time: 4:00:01 AM
User: DOMAIN\Username
Computer: 57X1
Description:
DCOM got error "Class not registered " from the computer 36X1 when
attempting to activate the server:
{10FCBFBC-705C-41B4-BF9A-8E49F9B96015}

This has been occurring about 5 times per minute while the user is logged on to the network. At the same time, computer 36X1 (mentioned in the error message above) is getting eventid's 538 and 576 relating to success logoffs and privileged uses respectively with the event id 538 relating to the user on the computer receiving event id 10006.

The users of either computer have not been programming of any kind let alone using DCOM. In addtion computer 57x1 has also been getting the privilege us event id in the securty log coming from User "DOMAIN\36x1$" as if the overall result is that there is one or two way communication between these two computers, 36x1 and 57x1. Both computers are running XP Pro service pack 1.

I have checked both computers for viruses, adware and spyware but they come clean.

Any ideas as to what is causing this would be appreciated.

 

[LloydSev]

Event ID: 10006

Source DCOM

Type Error

Description Dcom got error "<error description>" from the computer <computer name> when attempting to activate the server: <server component>

http://www.eventid.net/display.asp?eventid=10006&eventno=272&source=DCOM&phase=1

Read through those notes carefully, as we do not know the software you are using on the machines.

Computer/Network Technician
CCNA

 

[bcastner]

There was an earlier report on this:

http://www.tek-tips.com/viewthread.cfm?qid=972557&page=1

I think I would feel better if that laptop was scanned for malware: faq608-4650

It is odd to see a GUID identification for a server component.

 

[linney]

Probably unrelated but these might give you a few clues?

Repeated DCOM errors in Event veiwer
thread779-893026

DCOM error after SP2 update
thread779-900341

 

[gbl]

OK thanks for all the suggestions - it is the printer issue after all. Galdunick had the right idea on the eventid.net page. The user was at one time accessing an HP printer that was attached to the other computer. If the suggested fix does not resolve this, I will check the other suggestions and post again if nothing else works.

 

[LloydSev]

Glad I could point you in the right direction.

Computer/Network Technician
CCNA