DCOM got error "Logon failure: unknown user name or bad password

[jackknob]

I am receiving the following error in the event viewer. It starts at 1:02 am and stops at 2:02 am every night. The message comes up approximately 2,000 times in that one hour time period. The server that it is happening on is running MS Server 2000 SP4. The messages started a few weeks back and occur every night in that specific time period. The account that the message is referring to is my account. I have admin level privelages on the network, though I have not, nor anyone else in the company installed anything that would be trying to logon with my account. I looked at all the services on the server and none of them are configured to use my account name to run.

This is the error (obviously, I didn't put in my account name or the domain name). At this point I have a feeling it might be a virus/spyware or something malicious, but I would like to exhaust all other possibilities before I proceed.

DCOM got error "Logon failure: unknown user name or bad password. " and was unable to logon 'Domain Name\Administrator Name' in order to run the server:
{B2B30542-D976-11D3-B188-0040056AC398}

[chris5126]

It might be to do with your lease this is just a stab in the dark but have heard of this problem before and this resolved it, same symptons.

[antioed]

Not necessarily related but it sure looks like it could be and sheds some light on the nature of the problem: http://support.microsoft.com/default.aspx?scid=kb;en-us;255770

[Fulgor]

I am actually running into the same problem. However it did so when i changed my back admin password. anyone knows how to take care of it?

[FragFighter]

what version of microsoft are you running?

[digioz]

I am actually running into the same problem. However it did so when i changed my back admin password. anyone knows how to take care of it?

I had the same issue with a MS SQL Great Plains Server. The way I fixed it was:

1. Go to Start > Programs > Administrative Tools > Component Services

2. Expand the Component Services > Computers > My Computer > COM+ Applications.

3. Select the application in question (in my case it was eConnect 9), right click on it and choose "Properties".

4. Click on the Identity Tab. On that tab there is a "This user:" radio button which contains the username and password that my Component is using. Simply change the user login information there and restart your machine.

I hope this helps.

Pete Soheil
DigiOz Multimedia http://www.digioz.com

[!hammer]

Digioz -

This same fix worked for me as well. thanks for the post.

I had the same issue with a MS SQL Great Plains Server. The way I fixed it was:

1. Go to Start > Programs > Administrative Tools > Component Services

2. Expand the Component Services > Computers > My Computer > COM+ Applications.

3. Select the application in question (in my case it was eConnect 9), right click on it and choose "Properties".

4. Click on the Identity Tab. On that tab there is a "This user:" radio button which contains the username and password that my Component is using. Simply change the user login information there and restart your machine.

I hope this helps.

Pete Soheil DigiOz Multimedia http://www.digioz.com

[digioz]

Digioz -

This same fix worked for me as well. thanks for the post.

You are welcome. Glad it worked out for you. :)

Pete

[Patrik Svedman]

@Digioz ( & co)

You are absolutely right, though sometimes some applications/services run under the "\component services\Computers\my computer\DCOM" directory. These are also effected if you change a password for if they are set to operate under a certain user account. If one accedently changed the password for one of these services, one will feel as if he/she were thrown into hell.

There are ofter lots of services in there and they aren't too keen on telling you which on operates with or without passwords. Unless you open them, one by one and check the "Identity tab". My tip:

1. open the event viewer/logbook of your computer
2. find the system log.
3. open the errors (one at a time) marked "DCOM" and you'll find the usual message and a long string of letters and numbers.
3.1 This string is relatable directly to a DCOM service that is operating under a certain password
4. check the DCOM services for the string that you find in the error message.
5. once you find the matching service and string you can right click and choose properties.
6. enter the "identity tab" and there you'll see that the service is operating under a certain username & password.
7. Correct the password and click "APPLY"

it's just a small tip and I hope that you'll never have to do this. even so, if you would encounter this situation, you'll have a head start if you relate to the little guide I posted (-;

Best Regards and Good Luck:
Patrik Svedman - Svedmani

[digioz]

Thanks for elaborating on what I said in my post above, although you are pretty much saying the exact same thing I was.

Pete

[Patrik Svedman]

What I wanted to point out was that one can refer to the Event Viewer if there is need to change the password in the DCOM aswell. Since even in the detailed list view, you wont be able to see if certain accounts were chosen to operate the services. Unless you want to open the services one by one (:

Note that the DCOM and the COM+ directories in Component Services are two different "folders" and list the services differently.

I certainly did not want to walk all over your post, Pete. Even though now that I look at my own post, I pretty much said the same thing. Sorry

-- Patrik

[digioz]

That's fine. It should be pretty much common sense for any Server Admin to refer to the Event Log as part of troubleshooting any problem, which is why I didn't include it but it certainly should be done.

Pete