2 of my 6 read/wright 2008 r2 domain controllers are pulling A LOT of dcom 10009 errors in the system log. the errors appear to be llimited to certail IP's. Those IP's are not for windows systems and then others of them are for systems external to our network. The posts I have read point to it being an issue on the remote system (COM config or Firewall). But its odd that this only occurs on 2 domain controllers (all they do is DNS/AD).

Hello, I recommend you check below article, which will gives you explanation and user actions forEvent ID:10009 http://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=Windows%20Operating%20System&ProdVer=5.0&EvtID=10009&EvtSrc=DCOM&LCID=1033 Regards, Ravikumar P

Hi, Error with Event ID 10009 is a known issue. The DCOM event ID 10009 will occur when a client workstation has a misconfigured firewall or other issues affecting its network communications within the domain. To attempt to resolve configuration issues with the firewall try the following: 1. Ensure that the remote computer is online Open an elevated Command Prompt window. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue. At the command prompt, type ping, followed by a space and the remote computer name, and then press ENTER. For example, to check that your server can communicate over the network with a computer named ContosoWS2008, type ping ContosoWS2008, and then press ENTER. A successful connection results in a set of replies from the other computer and a set of ping statistics. 2. Check the firewall settings and enable the firewall exception rule Click Start, and then click Run. Type wf.msc, and then click OK. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue. In the console tree, click Inbound rules. In the list of firewall exception rules, look for COM+ Network Access (DCOM In). If the firewall exception rule is not enabled, in the details pane click Enable rule, and then scroll horizontally to confirm that the protocol is TCP and the LocalPort is 135. Close Windows Firewall with Advanced Security. 3. Review available Extended RPC Error information for this event in Event Viewer Click Start, and then click Run. Type comexp.msc, and then click OK. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue. Under Console Root, expand Event Viewer (Local). In the details pane, look for your event in the Summary of Administrative Events, and then double-click the event to open it. The Extended RPC Error information that is available for this event is located on the Details tab. Expand the available items on the Details tab to review all available information. For more detailed information please refer to following MS articles: Event ID 10009 COM Remote Service Availability http://technet.microsoft.com/en-us/library/cc774368(v=WS.10).aspx How to troubleshoot DCOM 10009 error logged in system event? http://blogs.msdn.com/b/asiatech/archive/2010/03/16/how-to-troubleshoot-dcom-10009-error-logged-in-system-event.aspx Windows SBS 2008 Known Post Installation Event Errors http://support.microsoft.com/kb/957713 Hope this helps! TechNet Subscriber Support If you areTechNet Subscription user and have any feedback on our support quality, please send your feedback here. Lawrence TechNet Community Support

Hi, I would like to confirm what is the current situation? Have you resolved the problem? If there is anything that we can do for you, please do not hesitate to let us know, and we will be happy to help. Lawrence TechNet Community Support

Hi, As this thread has been quiet for a while, we assume that the issue has been resolved. At this time, we will mark it as Answered as the previous steps should be helpful for many similar scenarios. If the issue still persists and you want to return to this question, please reply this post directly so we will be notified to follow it up. You can also choose to unmark the answer as you wish. In addition, we'd love to hear your feedback about the solution. By sharing your experience you can help other community members facing similar problems. Thanks!Lawrence TechNet Community Support