Jump to content

DComLaunch/RPC crashing on W2003 x64 SP2


adamt
 Share

Recommended Posts

Dear knowledgeable MSFN-dwellers,

I have a Win2k3 R2 x64 server which has on various occasions, suffered a crash of the DCOMLaucnch or RPCss services, causing the machine to reboot. It leaves an entry in the system log like this:

Event Type: Information

Event Source: USER32

Event Category: None

Event ID: 1074

Date: 21/11/2010

Time: 00:32:28

User: NT AUTHORITY\SYSTEM

Computer: LON-SQL105a

Description:

The process winlogon.exe has initiated the restart of computer LON-SQL105a on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found

Reason Code: 0x30006

Shutdown Type: restart

Comment: Windows must now restart because the DCOM Server Process Launcher service terminated unexpectedly

Unfortunately, there's no drwatson dump file generated (although Dr Watson is configured as the default debugger). How can I capture the details of the crash for analysis?

There's no sign of malware on this server, and I'm a little puzzled as to what could cause these crashes.

Thanks in advance,

Adam.

Link to comment
Share on other sites

  • 3 weeks later...

Unfortunately, there's no drwatson dump file generated (although Dr Watson is configured as the default debugger). How can I capture the details of the crash for analysis?

There's no sign of malware on this server, and I'm a little puzzled as to what could cause these crashes.

Replying to my own post, in case anyone else is interested - I'm going to setup adplus to monitor the specific instances of svchost.exe which host DComLaunch and RPCss.

If I find anything useful, I'll post the details back here.

Link to comment
Share on other sites

You might want to consider breaking those out into their own svchost.exe - attaching to a shared svchost can be a bad thing.

Thanks for the suggestion.

DComLaunch and RpcSs are actually already in their own svchost.exe processes. A quick straw poll around some Win2003 machines suggests this is the default for that OS (although I notice that on my XP laptop, DComLaunch shares a process with Terminal Services).

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.


×
×
  • Create New...