Event ID 4100 & Generation of New User Folder in Documents and Settings

Discussion in 'Windows Server' started by Sean, Nov 27, 2006.

  1. Sean

    Sean Guest

    Hi

    Got a weird thing going on in my network.

    Every Monday morning a random selection from my Windows 2000 Machines will
    have the following error in the Application Log.

    Source: EventSystem
    Category: Firing Agent
    Event ID: 4100
    Description: The COM+ Event System failed to create an instance of the
    subscriber {ID} CoCreateInstanceEX returned HResult 8000401A

    When this happens a NEW user folder based on the default user is created for
    the person using the computer. Sometimes this happens more than once at
    start-up, so in Document's and Setting's we have;

    User folder
    User folder.domain
    User folder.domain.000
    User folder.domain.n

    These new folders creation timestamps coincide with the timestamps in the
    eventlog for the 4100 Event.

    This is taking up valuable time every Monday and REALLY getting on my
    nerves, historically the company dealt with this by remapping the folder
    link in the profilelist registry key.

    But this obviously has never fixed the issue.

    Any help much appreciated.
     
    Sean, Nov 27, 2006
    #1
    1. Advertisements

  2. Sean

    John John Guest

    John John, Nov 27, 2006
    #2
    1. Advertisements

  3. Sean

    Sean Guest

    Thanks for that John,

    I'm an event ID Subscriber and none of the information on there relates to
    the issue I am having.

    I'm wondering if the Event is a bit of a red herring. Weird that it only
    happens on 2K machines as well. And only on a Monday.

    ???
     
    Sean, Nov 27, 2006
    #3
  4. Sean,

    in regards to the error code, this is from the winerror.h file

    C:\>err 8000401A
    # for hex 0x8000401a / decimal -2147467238
    CO_E_RUNAS_LOGON_FAILURE winerror.h
    # The server process could not be started because the
    # configured identity is incorrect. Check the username and
    # password.
    # 1 matches found for "8000401A"

    is this "Firing Agent" using a "run as" method ?
    are all the dependant services started for this "Firing Agent" ?
    ensure that this "Firing Agent" is properly configured in regards to
    Accounts/Identity/Logon

    HTH,
    _Edwin.
     
    Edwin vMierlo, Nov 27, 2006
    #4
  5. Sean

    Sean Guest

    Thanks for that Edwin,

    I can't think of anything that needs to run as a specific user, thing is I
    don't know what the firing agent is trying to do on startup.

    On eventid.net it states the following about error code 0x8000401A in
    conjunction with COM;

    A process needed in order to perform an operation failed to start probably
    due to an issue with the user account that is configured as the identity for
    COM+ applications in the application that experiences the problem.

    This problem may arise if the account used is out-of-sync. For example
    Q255770, Q269001, and Q822699, troubleshoot situations in which the
    IWAM_machine account in not in synch with the metabase, the Security Account
    Manager (SAM), and COM+.

    In Q289650, the problem is fixed by reregistering the Mobsync.dll file from
    the server.

    The Qn's all relate to IIS or other technololgies not in use in our network,
    so no help there. There are no other Event's in any of the other logs that
    coincide or may shed some light on this.

    I'm wondering if the previous delvings into the registry by one of my
    predecessors has caused this by breaking a relationship between UID's and
    SID's in the registry, the only thing I do know for certain is that it has
    never happened on any of our XP Machines, only the 2000 ones.

    Cheers

    http://www.eventid.net/errorsdisplay.asp?error_code=8000401A
     
    Sean, Nov 27, 2006
    #5
  6. Sean,

    pardon my ignorance ... what is "Firing Agent" anyway ?
    and have you checked the "Identity" settings in your COM+ ?
    and / or can you re-install this app / com+ ?
     
    Edwin vMierlo, Nov 27, 2006
    #6
  7. Sean

    Sean Guest

    Edwin no need to feel ignorant, because I don't know what it is either.

    :)

    I thought it was a part of the system. I did a search for "firing agent" on
    google but didn't get much back in the way of leads. There's a Microsoft KB
    Article that mentions it but its more to do with systems management server
    (which we don't have).

    Still doesn't say what it is or what it does though.

    Re checking identity settings in COM+, how do I do this? I take it through
    the Component Services Snap-in for MMC but I don;t have a lot of experience
    using this.

    Cheers

    Sean
     
    Sean, Nov 27, 2006
    #7
  8. Sean,

    I presume that you mean http://support.microsoft.com/kb/831648

    do you have those symptoms, e.g. do you also get the Event ID 4356 ?

    If you do, please contact Microsoft Support to get the patch
    (they will email this to you without cost)

    rgds,
    Edwin.
     
    Edwin vMierlo, Nov 28, 2006
    #8
  9. Edwin vMierlo, Nov 28, 2006
    #9
  10. Sean

    Sean Guest

    Hello again Edwin,

    Yup, I looked up both of those, the first details the issue with 2K3 Server
    and XP and this issue is ONLY prevalent on 2K Pro machines.

    The second details mobsync in conjunction with offline folders, offline
    folders is disabled in group policy for computers so I doubt it is this.

    I have just installed WSUS and it shows that my predecessors patch and
    update management policy was... well none existant.

    Think i'll revisit this when I know all my machines are fully patched.

    *Groan*

    Heh, this is why I love working in IT.

    Thanks again for all your help Edwin.

    Sean
     
    Sean, Nov 28, 2006
    #10
  11. you're welcome
    and
    good luck

    rgds,
    Edwin.



     
    Edwin vMierlo, Nov 28, 2006
    #11
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.