COM: Custom Component Failure

 


COM Header


 


COM: Custom COM Component Failure


 


Description: A COM component is a piece of code that exists as an executable file or DLL.  A COM component can act in either a client (requesting service or functionality from another component) or server (providing service or functionality to other components) role. 


 


 


Scoping the Issue: DCOM specific questions



  • Are the end-users affected and Local/Domain Administrator accounts affected or just the end-user accounts?

  • Are there any network related errors? Is RPC (DCOM) working?

General DCOM related questions



  • When did the issue start occurring?

  • What has changed?

  • Application update?

  • Hardware update/failure?

  • Driver update?

  • Antivirus definition update?

  • Security hotfix update ?

  • GPO modification?

  • How did you get notified about the problem? Did the end-users call the helpdesk?

  • Are all the client workstations and servers affected?

  • What OS and Service Pack are affected?

Windows NT 4.0 Wks/Srv/TS


Windows 2000 Pro/Srv


Windows XP Pro


Windows Server 2003


Windows 2008



  • Does the issue occur on machines in the same subnet or just on a LAN or WAN?

  • Can you ping the server when the issue occurs?

  • Can you open network shares when the issue occurs?

  • How frequently does the DCOM error occur?

  • Does the DCOM errors occur during any particular time of day, or does it occur when a certain application is run?

  • Are there any application specific errors on the screen?

  • How does the machine recover? Do you just wait? Or do you have to reboot the machine?

 


 


 


Data Gathering: When troubleshooting DCOM related errors, keep in mind that the issues could be related to their permission lockdown, network infrastructure, 3rd party or custom application.


 



  • Collect MPSReports/MSDT

  • Collect Process Monitor – Process Monitor should be gathered on both the Server and as well as the clients that are having the issues, while the issue is occurring.

  • Collect Network trace while the issue is occurring.

  • Get a list of DCOM permissions

  • Export The HKEY_CLASSES_ROOT Key From The Problem Machine

 



 


Troubleshooting / Resolution: The owner of the failing COM component is important information to determine first. The reason for this is that if it is a Microsoft component, we need to make sure the right group is engaged, and if it is a third-party component, the vendor needs to be engaged. You can determine the ownership of a COM component by viewing the GUID of the component.


 


To determine the GUID of a COM component:


 



  1. Click Start, and then click Run.

  2. In Open, type Eventvwr.msc, and then click OK

  3. Click on the System Event log

  4. Look under Source for DCOM

  5. When you find the failing component, double click to open it.

  6. Under description, highlight and select the {GUID}. For instance:

 


            DCOM GUID


 


 


Search the registry for the GUID to find the application:


 



  1. Click on Start, and then click Run

  2. In Open, type Regedit, and then click OK

  3. Browse to HKEY_CLASSES_ROOT

  4. Click Edit, and then click on Find

  5. Under LocalServer32, the path to the application should be shown

  


 


Additional Resources: