hello domain controller running server w2k3 sp2 I get informational entries in the app log source = sshd Event Type: Information Event Source: sshd Event Category: None Event ID: 0 Date: 6/17/2012 Time: 4:05:30 PM User: ADMINISTRATION\administrator Computer: ML350G5BPM Description: The description for Event ID ( 0 ) in Source ( sshd ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: sshd: PID 10012: input_userauth_request: invalid user administration\\administrator. then in the system log at the same times I get Event Type: Error Event Source: DCOM Event Category: None Event ID: 10009 Date: 6/18/2012 Time: 11:24:51 AM User: N/A Computer: ML350G5BPM Description: DCOM was unable to communicate with the computer 192.168.40.50 using any of the configured protocols. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. I get a ton of these with various IP addresses for all kinds of equipment on my LAN (switches printers workstations etc this is just an observation that the sshd thing happens at the same times I get all these dcom errors

Might ask them here about the first one. http://cygwin.com/who.html For the second one. http://technet.microsoft.com/en-us/library/cc774368(v=ws.10) Regards, Dave Patrick .... Microsoft Certified Professional Microsoft MVP [Windows] Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

I did see alot of stuff out there pertaining to this cygwin..what is that ?

More about it here. http://cygwin.com/faq-nochunks.html#faq.what Regards, Dave Patrick .... Microsoft Certified Professional Microsoft MVP [Windows] Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

I never heard of these "tools" I know I never installed cgywin..unless it would have been part of some tols idownloaded form Miocrosoft .... pstolols etc......cna it be unistalled or how would I actually verify that this tool kit is indeed installed ( add/remove programs ?) we dont do any devleopment owrk here

No idea really. Since it is in application log it most likely is third party. Also since its informational you can probably ignore it. Regards, Dave Patrick .... Microsoft Certified Professional Microsoft MVP [Windows] Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

I do have HP's OPNESSHServices 5.3 1-1 listed in my add/remove programs This server runs alot of my HP "stuff" like Procurve manager and SIM manager

yeah I am not so worried aboutthe ssh but the DCOMM there e are so many logged during thiose 2 time slots

Yes, we also have a lot of HP servers but I've not seen this one. Might ask them here. http://h30499.www3.hp.com/t5/Servers/ct-p/itrc-122 Regards, Dave Patrick .... Microsoft Certified Professional Microsoft MVP [Windows] Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

I'd follow the steps here. http://technet.microsoft.com/en-us/library/cc774368(v=WS.10).aspx Regards, Dave Patrick .... Microsoft Certified Professional Microsoft MVP [Windows] Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

would you know a link for server 2003 ?

Possibly this one. http://blogs.msdn.com/b/asiatech/archive/2010/03/16/how-to-troubleshoot-dcom-10009-error-logged-in-system-event.aspx Regards, Dave Patrick .... Microsoft Certified Professional Microsoft MVP [Windows] Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

Hi, Event ID 10009 descriptions for old Windows version: http://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=Windows%20Operating%20System&ProdVer=5.0&EvtID=10009&EvtSrc=DCOM&LCID=1033 Event ID 10009 indicates network connection issue, so its not limited on Windows Version. You may try article Dave Patrick provided above: Event ID 10009 COM Remote Service Availability http://technet.microsoft.com/en-us/library/cc774368(v=WS.10).aspx Also this issue has been recorded in other OS version, and it provide similar steps to troubleshoot this problem: Ensure that the remote computer is onlineCheck the firewall settings and enable the firewall exception ruleReview available Extended RPC Error information for this event in Event Viewer Windows SBS 2008 Known Post Installation Event Errors http://support.microsoft.com/kb/957713 For more information please refer to following MS articles: Event 10009 - Dcom was unable to communicate with the computer http://social.technet.microsoft.com/Forums/en-US/smallbusinessserver/thread/6b3a1b12-6582-49a9-86d4-cbe062c1ff43 You cannot obtain detailed error information about DCOM 10009 errors in Windows Server 2003 http://support.microsoft.com/kb/910695 Lawrence TechNet Community Support

obviosly there is some process/routine that is making all this DCOMM stuff happen..... I need to understand what is acutall making all the dcomm event happen every day at the same time I cant actually go to every ip address listed in all these dcom events in orderto tweak that computers firewall......some of the IP addreses listed don make sence (printers and switxches and so on) is it HPinsight stuff ? or i see in ther app log at the same times SSH entries can SSH stuff go out and call Dcomm......I would liek t obe able to pinpoint why this happens instead of how t ofix every entry in the log ..there are tons of thises all at 11:00am --> 11:15 am every day so it looks like sone sort of scheduled "thing"

Maybe this one helps. http://h30499.www3.hp.com/t5/ITRC-HP-Systems-Insight-Manager/DCOM-10009-errors/td-p/4182524 Regards, Dave Patrick .... Microsoft Certified Professional Microsoft MVP [Windows] Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

Maybe this one helps. http://h30499.www3.hp.com/t5/ITRC-HP-Systems-Insight-Manager/DCOM-10009-errors/td-p/4182524 Regards, Dave Patrick .... Microsoft Certified Professional Microsoft MVP [Windows] Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

Dave ...I just found yesterday that my SIM manager is sheduled to DISCOVER at these very same times ........so yes you are on the same track......I thank you nowI know where to concentrate

Good to hear of progress. You're welcome. Regards, Dave Patrick .... Microsoft Certified Professional Microsoft MVP [Windows] Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.