RE: attempt to launch a DCOM server?

From: Vincent Aikema <vaikema(at)hotmail.com>
Date: Thu Aug 14 2003 - 03:47:10 EDT

Hmm, that sheds some light in my situation. The server in question once had IIS running (only internally) for Certificate Services (web enrollment). I had since messed up IIS (can't actually remember the circumstance) and uninstalled it, but the Certificate Service is still running, minus the web enrollment.

Or it should be.

I see now that although the Certificate Service is set to automatic, the service was actually stopped. It probably didn't start automatically after running the MS03-026 patch (related?), and since then it is potentially logical that attempts to renew the certificate when the service is stopped COULD create this DCOM error under the circumstances (following the logic of Mike's situation). I don't know the underlying mechanism behind the certificate process, but I'm gladly embracing the idea that this is the reason. In fact I'm growing more confident by the minute :-).

Now that the service is started again, I will watch for future DCOM errors. If they pop up again, well, my little bubble will burst and I'll start from step one again. And perhaps I should also fix that IIS/web enrollment business...

Thanks Mike!

----Original Message Follows----
From: "Mike O'Toole" <hoople_ny@yahoo.com> To: "'Vincent Aikema'" <vaikema@hotmail.com> CC: <focus-ms@securityfocus.com>
Subject: RE: attempt to launch a DCOM server? Date: Wed, 13 Aug 2003 18:56:24 -0400

I've seen this error (at boot up) when some application is trying to launch the 'IISAdmin Service' to enable it's web management interface. This was on a server that once had IIS in use but when it was decommissioned. The IIS services were set to 'disabled' startup state.

Mike

> -----Original Message-----

---

The new MSN 8: advanced junk mail protection and 2 months FREE* http://join.msn.com/?page=features/junkmail

---

Your network firewall and IDS products do not prevent Web application attacks - the most common form of online exploitation- resulting in Web defacement, data theft, sabotage and fraud. KaVaDo is the only company that provides a complete suite of Web application security products.
Download a FREE whitepaper on "Security Policy Automation for Web Applications":http://www.securityfocus.com/Kavado-focus-ms

---

Received on Thu Aug 14 12:30:23 2003