Errors After Changing Administrator Password

We had to change our domain administrator password, and it (obviously)
caused a few things to break. I have been able to resolve most of them, but
was looking for some verification on this problem in particular.

I noticed the following in the event logs this morning, each logged about
once per second:

System Log:
Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10004
Date: 1/12/2006
Time: 2:00:36 AM
User: N/A
Computer: BRADFORDDC01
Description:
DCOM got error "Logon failure: unknown user name or bad password. " and was
unable to logon BRADFORDREALES\ADMINISTRATOR in order to run the server:
{B2B30542-D976-11D3-B188-0040056AC398}

Security Log:
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 1/12/2006
Time: 2:00:29 AM
User: NT AUTHORITY\SYSTEM
Computer: BRADFORDDC01
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: ADMINISTRATOR
Domain: BRADFORDREALES
Logon Type: 4
Logon Process: DCOMSCM
Authentication Package: Negotiate
Workstation Name: BRADFORDDC01
Caller User Name: BRADFORDDC01$
Caller Domain: BRADFORDREALES
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 828
Transited Services: -
Source Network Address: -
Source Port: -


Using eventid.net, I believe that I was able to find the offending account
information by doing the following:
Opening Administrative Tools...Component Services...Computers...My
Computer...DCOM Config.

At this point, I was prompted with a few alert boxes: DCOM Configuration
Warning! The CLSID {...} item, ... and title PccFrameWindow Class has the
named value AppID, but is not recorded under \\HKEY_CLASSES_ROOT\AppId. Do
you wish to record it? I chose no for this and another popup for a
different application (I believe these are related to the accounting
software).

Once in DCOM Config, I looked for the application ID referenced in the
email, and found it for the application "BDmTk." Sure enough, when I went
into the Properties...Identity tab, it was set to run as the Administrator,
with a place to enter the password.

So my question is, is it safe to update this password? My gut says that it
is, but I'm not familiar with DCOM Config at all, so I am looking for some
validation before I plow forward.

Thanks,

Rob

Hello Robert,

Thank you for posting to the SBS Newsgroup.

I understand that after change Administrator Account, you found Event IDs
10004 and 529 on the SBS 2K3 Server. If I have misunderstood your concern,
please let me know.

Based on my experience, this issue is complicated, and we need time to
troubleshoot. Please take your time to read through all my reply, try the
suggestions and gather the information for further research:

=======

Suggestion:

The Event 10004 should indicate a class ID for the component and you can
find the class ID referring to a component in
HKEY_CLASSES_ROOT\CLSID\B2B30542-D976-11D3-B188-0040056AC398}.

Please check it from the registry of this problem machine:

Start > Run > Regedit. Navigate to HKEY_CLASSES_ROOT\CLSID\.

When you locate the
HKEY_CLASSES_ROOT\CLSID\B2B30542-D976-11D3-B188-0040056AC398, check the
subkey InprocServer32 to find the dll file and check the registry key to
find any related information for this component. Based on these
information, we can determine what software includes this component. I did
not find this class ID in our database. Therefore, I think it is a third
party program. If you find the program, you may uninstall it and contact
the manufacturer to check it.

You also can export the registry key to me:

1. Find the node with the same name {B2B30542-D976-11D3-B188-0040056AC398}.
2. Choose the {B2B30542-D976-11D3-B188-0040056AC398} node.
3. Click from menu File > Export Registry.
4. Export this node to a .txt file (NOT the .reg file) on your desktop, and
send it to me.

You may also check this COM object in the DCOMCNFG.

=============

If the issue persists, please help me to gather following information for
further research:

a. How did you change the Domain Administrator account? Please fully list
your steps.

b. Can you use the Administrator account to log in SBS Server?

c. Is BRADFORDDC01 the SBS Server?

d. Did you use the changed password Administrator account to do following
performance on the Server:

"Opening Administrative Tools...Component Services...Computers...My
Computer...DCOM Config."

e. You mentioned "prompted with a few alert boxes". I strongly suggest that
you capture screen shots for each of the alert boxes and send them to my
mailbox so we can better understand your issue.

f. I also found following KB articles for you. If you have the exact same
issue as described inside, please apply the steps and see how it goes.

312497 PRB: COM+ Application Under Domain Account Fails Intermittently
http://support.microsoft.com/default...b;EN-US;312497

PRB: Cannot Expand "My Computer" in Component Services MMC Snap-In
http://support.microsoft.com/?id=301919

Please take your time to perform the steps, and gather the information. I
am looking forward to hearing from you!

Best regards,

Brandy Nee

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities...s/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.



--------------------
>From: "Robert Zahm" <robzahm@hotmail.com>
>Subject: Errors After Changing Administrator Password
>Date: Thu, 12 Jan 2006 09:04:16 -0600
>Lines: 74
>X-Priority: 3
>X-MSMail-Priority: Normal
>X-Newsreader: Microsoft Outlook Express 6.00.2900.2670
>X-RFC2646: Format=Flowed; Original
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670
>Message-ID: <uh$J2l4FGHA.2064@TK2MSFTNGP09.phx.gbl>
>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: 64-45-168-10.static.cypresscom.net 64.45.168.10
>Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP09.phx.gbl
>Xref: TK2MSFTNGXA02.phx.gbl microsoft.public.windows.server.sbs:236086
>X-Tomcat-NG: microsoft.public.windows.server.sbs
>
>We had to change our domain administrator password, and it (obviously)
>caused a few things to break. I have been able to resolve most of them,
but
>was looking for some verification on this problem in particular.
>
>I noticed the following in the event logs this morning, each logged about
>once per second:
>
>System Log:
>Event Type: Error
>Event Source: DCOM
>Event Category: None
>Event ID: 10004
>Date: 1/12/2006
>Time: 2:00:36 AM
>User: N/A
>Computer: BRADFORDDC01
>Description:
>DCOM got error "Logon failure: unknown user name or bad password. " and
was
>unable to logon BRADFORDREALES\ADMINISTRATOR in order to run the server:
>{B2B30542-D976-11D3-B188-0040056AC398}
>
>Security Log:
>Event Type: Failure Audit
>Event Source: Security
>Event Category: Logon/Logoff
>Event ID: 529
>Date: 1/12/2006
>Time: 2:00:29 AM
>User: NT AUTHORITY\SYSTEM
>Computer: BRADFORDDC01
>Description:
>Logon Failure:
> Reason: Unknown user name or bad password
> User Name: ADMINISTRATOR
> Domain: BRADFORDREALES
> Logon Type: 4
> Logon Process: DCOMSCM
> Authentication Package: Negotiate
> Workstation Name: BRADFORDDC01
> Caller User Name: BRADFORDDC01$
> Caller Domain: BRADFORDREALES
> Caller Logon ID: (0x0,0x3E7)
> Caller Process ID: 828
> Transited Services: -
> Source Network Address: -
> Source Port: -
>
>
>Using eventid.net, I believe that I was able to find the offending account
>information by doing the following:
>Opening Administrative Tools...Component Services...Computers...My
>Computer...DCOM Config.
>
>At this point, I was prompted with a few alert boxes: DCOM Configuration
>Warning! The CLSID {...} item, ... and title PccFrameWindow Class has the
>named value AppID, but is not recorded under \\HKEY_CLASSES_ROOT\AppId.
Do
>you wish to record it? I chose no for this and another popup for a
>different application (I believe these are related to the accounting
>software).
>
>Once in DCOM Config, I looked for the application ID referenced in the
>email, and found it for the application "BDmTk." Sure enough, when I went
>into the Properties...Identity tab, it was set to run as the
Administrator,
>with a place to enter the password.
>
>So my question is, is it safe to update this password? My gut says that
it
>is, but I'm not familiar with DCOM Config at all, so I am looking for some
>validation before I plow forward.
>
>Thanks,
>
>Rob
>
>
>

Brandy,

Thanks for the reply. My comments are below.

Thanks again!

Rob

""Brandy Nee [MSFT]"" <v-branee@online.microsoft.com> wrote in message
news:4%23a7CPBGGHA.1240@TK2MSFTNGXA02.phx.gbl...
> Hello Robert,
>
> Thank you for posting to the SBS Newsgroup.
>
> I understand that after change Administrator Account, you found Event IDs
> 10004 and 529 on the SBS 2K3 Server. If I have misunderstood your concern,
> please let me know.
>
> Based on my experience, this issue is complicated, and we need time to
> troubleshoot. Please take your time to read through all my reply, try the
> suggestions and gather the information for further research:
>
> =======
>
> Suggestion:
>
> The Event 10004 should indicate a class ID for the component and you can
> find the class ID referring to a component in
> HKEY_CLASSES_ROOT\CLSID\B2B30542-D976-11D3-B188-0040056AC398}.
>
> Please check it from the registry of this problem machine:
>
> Start > Run > Regedit. Navigate to HKEY_CLASSES_ROOT\CLSID\.
>
> When you locate the
> HKEY_CLASSES_ROOT\CLSID\B2B30542-D976-11D3-B188-0040056AC398, check the
> subkey InprocServer32 to find the dll file and check the registry key to
> find any related information for this component. Based on these
> information, we can determine what software includes this component. I did
> not find this class ID in our database. Therefore, I think it is a third
> party program. If you find the program, you may uninstall it and contact
> the manufacturer to check it.
>
> You also can export the registry key to me:
>
> 1. Find the node with the same name
> {B2B30542-D976-11D3-B188-0040056AC398}.
> 2. Choose the {B2B30542-D976-11D3-B188-0040056AC398} node.
> 3. Click from menu File > Export Registry.
> 4. Export this node to a .txt file (NOT the .reg file) on your desktop,
> and
> send it to me.
>
> You may also check this COM object in the DCOMCNFG.
>

I was unable to find
HKEY_CLASSES_ROOT/CLSID/{B2B30542-D976-11D3-B188-0040056AC398}. I am able
to find it in DCOM_CONFIG though (this occurs on the SBS machine).

> =============
>
> If the issue persists, please help me to gather following information for
> further research:
>
> a. How did you change the Domain Administrator account? Please fully list
> your steps.
I logged into the server, opened Server Management, selected the
Administrator account and clicked "Change Password."

>
> b. Can you use the Administrator account to log in SBS Server?
Yes

>
> c. Is BRADFORDDC01 the SBS Server?
Yes

>
> d. Did you use the changed password Administrator account to do following
> performance on the Server:
>
> "Opening Administrative Tools...Component Services...Computers...My
> Computer...DCOM Config."
I used my login, which is a member of the domain admins group. This also
works for the Administrator account.

>
> e. You mentioned "prompted with a few alert boxes". I strongly suggest
> that
> you capture screen shots for each of the alert boxes and send them to my
> mailbox so we can better understand your issue.
I sent the screenshots to you.

>
> f. I also found following KB articles for you. If you have the exact same
> issue as described inside, please apply the steps and see how it goes.
>
> 312497 PRB: COM+ Application Under Domain Account Fails Intermittently
> http://support.microsoft.com/default...b;EN-US;312497
It doesn't fail intermittently, it fails at night every second from 2-3 AM.
My guess is that the Administrator password was not updated in this case.
Is there danger in updating this password through DCOM_CONFIG?

>
> PRB: Cannot Expand "My Computer" in Component Services MMC Snap-In
> http://support.microsoft.com/?id=301919
I am able to expand "My Computer" in Component Services.

>
> Please take your time to perform the steps, and gather the information. I
> am looking forward to hearing from you!
>
> Best regards,
>
> Brandy Nee
>
> Microsoft CSS Online Newsgroup Support
>
> Get Secure! - www.microsoft.com/security
> ======================================================
> This newsgroup only focuses on SBS technical issues. If you have issues
> regarding other Microsoft products, you'd better post in the corresponding
> newsgroups so that they can be resolved in an efficient and timely manner.
> You can locate the newsgroup here:
> http://www.microsoft.com/communities...s/default.aspx
>
> When opening a new thread via the web interface, we recommend you check
> the
> "Notify me of replies" box to receive e-mail notifications when there are
> any updates in your thread. When responding to posts via your newsreader,
> please "Reply to Group" so that others may learn and benefit from your
> issue.
>
> Microsoft engineers can only focus on one issue per thread. Although we
> provide other information for your reference, we recommend you post
> different incidents in different threads to keep the thread clean. In
> doing
> so, it will ensure your issues are resolved in a timely manner.
>
> For urgent issues, you may want to contact Microsoft CSS directly. Please
> check http://support.microsoft.com for regional support phone numbers.
>
> Any input or comments in this thread are highly appreciated.
> ======================================================
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
>
>
>
> --------------------
>>From: "Robert Zahm" <robzahm@hotmail.com>
>>Subject: Errors After Changing Administrator Password
>>Date: Thu, 12 Jan 2006 09:04:16 -0600
>>Lines: 74
>>X-Priority: 3
>>X-MSMail-Priority: Normal
>>X-Newsreader: Microsoft Outlook Express 6.00.2900.2670
>>X-RFC2646: Format=Flowed; Original
>>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670
>>Message-ID: <uh$J2l4FGHA.2064@TK2MSFTNGP09.phx.gbl>
>>Newsgroups: microsoft.public.windows.server.sbs
>>NNTP-Posting-Host: 64-45-168-10.static.cypresscom.net 64.45.168.10
>>Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP09.phx.gbl
>>Xref: TK2MSFTNGXA02.phx.gbl microsoft.public.windows.server.sbs:236086
>>X-Tomcat-NG: microsoft.public.windows.server.sbs
>>
>>We had to change our domain administrator password, and it (obviously)
>>caused a few things to break. I have been able to resolve most of them,
> but
>>was looking for some verification on this problem in particular.
>>
>>I noticed the following in the event logs this morning, each logged about
>>once per second:
>>
>>System Log:
>>Event Type: Error
>>Event Source: DCOM
>>Event Category: None
>>Event ID: 10004
>>Date: 1/12/2006
>>Time: 2:00:36 AM
>>User: N/A
>>Computer: BRADFORDDC01
>>Description:
>>DCOM got error "Logon failure: unknown user name or bad password. " and
> was
>>unable to logon BRADFORDREALES\ADMINISTRATOR in order to run the server:
>>{B2B30542-D976-11D3-B188-0040056AC398}
>>
>>Security Log:
>>Event Type: Failure Audit
>>Event Source: Security
>>Event Category: Logon/Logoff
>>Event ID: 529
>>Date: 1/12/2006
>>Time: 2:00:29 AM
>>User: NT AUTHORITY\SYSTEM
>>Computer: BRADFORDDC01
>>Description:
>>Logon Failure:
>> Reason: Unknown user name or bad password
>> User Name: ADMINISTRATOR
>> Domain: BRADFORDREALES
>> Logon Type: 4
>> Logon Process: DCOMSCM
>> Authentication Package: Negotiate
>> Workstation Name: BRADFORDDC01
>> Caller User Name: BRADFORDDC01$
>> Caller Domain: BRADFORDREALES
>> Caller Logon ID: (0x0,0x3E7)
>> Caller Process ID: 828
>> Transited Services: -
>> Source Network Address: -
>> Source Port: -
>>
>>
>>Using eventid.net, I believe that I was able to find the offending account
>>information by doing the following:
>>Opening Administrative Tools...Component Services...Computers...My
>>Computer...DCOM Config.
>>
>>At this point, I was prompted with a few alert boxes: DCOM Configuration
>>Warning! The CLSID {...} item, ... and title PccFrameWindow Class has the
>>named value AppID, but is not recorded under \\HKEY_CLASSES_ROOT\AppId.
> Do
>>you wish to record it? I chose no for this and another popup for a
>>different application (I believe these are related to the accounting
>>software).
>>
>>Once in DCOM Config, I looked for the application ID referenced in the
>>email, and found it for the application "BDmTk." Sure enough, when I went
>>into the Properties...Identity tab, it was set to run as the
> Administrator,
>>with a place to enter the password.
>>
>>So my question is, is it safe to update this password? My gut says that
> it
>>is, but I'm not familiar with DCOM Config at all, so I am looking for some
>>validation before I plow forward.
>>
>>Thanks,
>>
>>Rob
>>
>>
>>
>

Hello Robert,

Thank you for posting back!

I am sorry for the delayed response due to the weekend. Please understand
that the newsgroups are staffed weekdays by Microsoft Support professionals
to answer your systems and applications questions. Your understanding is
greatly appreciated!

I understand that the {B2B30542-D976-11D3-B188-0040056AC398} indicates your
accounting software. Based on my experience, some 3rd party services run
under the administrative account who installs them. So you need to open the
services.msc snap-in, open each associated service and make sure to change
the administrator's password if it runs under this account.

If the issue persists, please help to gather following information:

On the server, run "eventvwr" (without quotation marks),check whether there
are any errors. If yes, double click it, click the Copy button and paste
the full content to the Newsgroup.

Please take your time to perform the steps. If you have any further
updates, please feel free to let me know. I am looking forward to hearing
from you!

Best regards,

Brandy Nee

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities...s/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.



--------------------
>From: "Robert Zahm" <robzahm@hotmail.com>
>References: <uh$J2l4FGHA.2064@TK2MSFTNGP09.phx.gbl>
<4#a7CPBGGHA.1240@TK2MSFTNGXA02.phx.gbl>
>Subject: Re: Errors After Changing Administrator Password
>Date: Fri, 13 Jan 2006 09:25:06 -0600
>Lines: 250
>X-Priority: 3
>X-MSMail-Priority: Normal
>X-Newsreader: Microsoft Outlook Express 6.00.2900.2670
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670
>X-RFC2646: Format=Flowed; Original
>Message-ID: <uGxUJWFGGHA.1032@TK2MSFTNGP15.phx.gbl>
>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: 64-45-168-10.static.cypresscom.net 64.45.168.10
>Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP15.phx.gbl
>Xref: TK2MSFTNGXA02.phx.gbl microsoft.public.windows.server.sbs:236414
>X-Tomcat-NG: microsoft.public.windows.server.sbs
>
>Brandy,
>
>Thanks for the reply. My comments are below.
>
>Thanks again!
>
>Rob
>

Brandy,

I don't believe that they key mentioned belongs to the accounting software,
as they claim to have never heard of it (the popups under DCOM CONFIG are
from the accounting software however). I took your suggestion about looking
for services running as Administrator, and realized that our scanning
software, scanrouter, is running with administrative privileges. I can't
believe that I hadn't connected the dots until now, but I'm guessing that
this was the error (and that no one has used the scanner recently). I
changed the password for the account, and will report back tomorrow if the
event logs have cleared.

Thanks for all of your help!

Rob

""Brandy Nee [MSFT]"" <v-branee@online.microsoft.com> wrote in message
news:YCV3R1nGGHA.1240@TK2MSFTNGXA02.phx.gbl...
> Hello Robert,
>
> Thank you for posting back!
>
> I am sorry for the delayed response due to the weekend. Please understand
> that the newsgroups are staffed weekdays by Microsoft Support
> professionals
> to answer your systems and applications questions. Your understanding is
> greatly appreciated!
>
> I understand that the {B2B30542-D976-11D3-B188-0040056AC398} indicates
> your
> accounting software. Based on my experience, some 3rd party services run
> under the administrative account who installs them. So you need to open
> the
> services.msc snap-in, open each associated service and make sure to change
> the administrator's password if it runs under this account.
>
> If the issue persists, please help to gather following information:
>
> On the server, run "eventvwr" (without quotation marks),check whether
> there
> are any errors. If yes, double click it, click the Copy button and paste
> the full content to the Newsgroup.
>
> Please take your time to perform the steps. If you have any further
> updates, please feel free to let me know. I am looking forward to hearing
> from you!
>
> Best regards,
>
> Brandy Nee
>
> Microsoft CSS Online Newsgroup Support
>
> Get Secure! - www.microsoft.com/security
> ======================================================
> This newsgroup only focuses on SBS technical issues. If you have issues
> regarding other Microsoft products, you'd better post in the corresponding
> newsgroups so that they can be resolved in an efficient and timely manner.
> You can locate the newsgroup here:
> http://www.microsoft.com/communities...s/default.aspx
>
> When opening a new thread via the web interface, we recommend you check
> the
> "Notify me of replies" box to receive e-mail notifications when there are
> any updates in your thread. When responding to posts via your newsreader,
> please "Reply to Group" so that others may learn and benefit from your
> issue.
>
> Microsoft engineers can only focus on one issue per thread. Although we
> provide other information for your reference, we recommend you post
> different incidents in different threads to keep the thread clean. In
> doing
> so, it will ensure your issues are resolved in a timely manner.
>
> For urgent issues, you may want to contact Microsoft CSS directly. Please
> check http://support.microsoft.com for regional support phone numbers.
>
> Any input or comments in this thread are highly appreciated.
> ======================================================
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
>
>
>
> --------------------
>>From: "Robert Zahm" <robzahm@hotmail.com>
>>References: <uh$J2l4FGHA.2064@TK2MSFTNGP09.phx.gbl>
> <4#a7CPBGGHA.1240@TK2MSFTNGXA02.phx.gbl>
>>Subject: Re: Errors After Changing Administrator Password
>>Date: Fri, 13 Jan 2006 09:25:06 -0600
>>Lines: 250
>>X-Priority: 3
>>X-MSMail-Priority: Normal
>>X-Newsreader: Microsoft Outlook Express 6.00.2900.2670
>>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670
>>X-RFC2646: Format=Flowed; Original
>>Message-ID: <uGxUJWFGGHA.1032@TK2MSFTNGP15.phx.gbl>
>>Newsgroups: microsoft.public.windows.server.sbs
>>NNTP-Posting-Host: 64-45-168-10.static.cypresscom.net 64.45.168.10
>>Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP15.phx.gbl
>>Xref: TK2MSFTNGXA02.phx.gbl microsoft.public.windows.server.sbs:236414
>>X-Tomcat-NG: microsoft.public.windows.server.sbs
>>
>>Brandy,
>>
>>Thanks for the reply. My comments are below.
>>
>>Thanks again!
>>
>>Rob
>>
>

Hello Rob,

Thank you for posting back!

Please take your time to test the issue. If you have any updates, please
feel free to let me know. I am always standing by and looking forward to
hearing from you!

Best regards,

Brandy Nee

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities...s/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.



--------------------
>From: "Robert Zahm" <robzahm@hotmail.com>
>References: <uh$J2l4FGHA.2064@TK2MSFTNGP09.phx.gbl>
<4#a7CPBGGHA.1240@TK2MSFTNGXA02.phx.gbl>
<uGxUJWFGGHA.1032@TK2MSFTNGP15.phx.gbl>
<YCV3R1nGGHA.1240@TK2MSFTNGXA02.phx.gbl>
>Subject: Re: Errors After Changing Administrator Password
>Date: Mon, 16 Jan 2006 09:34:31 -0600
>Lines: 114
>X-Priority: 3
>X-MSMail-Priority: Normal
>X-Newsreader: Microsoft Outlook Express 6.00.2900.2670
>X-RFC2646: Format=Flowed; Original
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670
>Message-ID: <e5JoZJrGGHA.1180@TK2MSFTNGP09.phx.gbl>
>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: 64-45-168-10.static.cypresscom.net 64.45.168.10
>Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP09.phx.gbl
>Xref: TK2MSFTNGXA02.phx.gbl microsoft.public.windows.server.sbs:237013
>X-Tomcat-NG: microsoft.public.windows.server.sbs
>
>Brandy,
>
>I don't believe that they key mentioned belongs to the accounting
software,
>as they claim to have never heard of it (the popups under DCOM CONFIG are
>from the accounting software however). I took your suggestion about
looking
>for services running as Administrator, and realized that our scanning
>software, scanrouter, is running with administrative privileges. I can't
>believe that I hadn't connected the dots until now, but I'm guessing that
>this was the error (and that no one has used the scanner recently). I
>changed the password for the account, and will report back tomorrow if the
>event logs have cleared.
>
>Thanks for all of your help!
>
>Rob
>

Brandy,

Changing the password on the service did not resolve the issue. I still
have a feeling that this "bdmtk" is related to the scanning software, as I
found one old google reference tying the two together.

I opened up the scanrouter administration utility and was prompted to change
a password. After changing the password I am being prompted to restart the
machine in order to save the changes. I will do this later today and see if
the errors still occur tomorrow.

The event log messages haven't changed from my initial post, every morning
from 1-2 AM I see the following in the System event log once per second:

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10004
Date: 1/17/2006
Time: 1:00:36 AM
User: N/A
Computer: BRADFORDDC01
Description:
DCOM got error "Logon failure: unknown user name or bad password. " and was
unable to logon BRADFORDREALES\ADMINISTRATOR in order to run the server:
{B2B30542-D976-11D3-B188-0040056AC398}

and the following in the Security event log for the same times:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 1/17/2006
Time: 2:00:31 AM
User: NT AUTHORITY\SYSTEM
Computer: BRADFORDDC01
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: ADMINISTRATOR
Domain: BRADFORDREALES
Logon Type: 4
Logon Process: DCOMSCM
Authentication Package: Negotiate
Workstation Name: BRADFORDDC01
Caller User Name: BRADFORDDC01$
Caller Domain: BRADFORDREALES
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 828
Transited Services: -
Source Network Address: -
Source Port: -

The SBS backup is the only other thing running at this time.

Thanks,

Rob

""Brandy Nee [MSFT]"" <v-branee@online.microsoft.com> wrote in message
news:gcUdo2wGGHA.3764@TK2MSFTNGXA02.phx.gbl...
> Hello Rob,
>
> Thank you for posting back!
>
> Please take your time to test the issue. If you have any updates, please
> feel free to let me know. I am always standing by and looking forward to
> hearing from you!
>
> Best regards,
>
> Brandy Nee
>
> Microsoft CSS Online Newsgroup Support
>
> Get Secure! - www.microsoft.com/security
> ======================================================
> This newsgroup only focuses on SBS technical issues. If you have issues
> regarding other Microsoft products, you'd better post in the corresponding
> newsgroups so that they can be resolved in an efficient and timely manner.
> You can locate the newsgroup here:
> http://www.microsoft.com/communities...s/default.aspx
>
> When opening a new thread via the web interface, we recommend you check
> the
> "Notify me of replies" box to receive e-mail notifications when there are
> any updates in your thread. When responding to posts via your newsreader,
> please "Reply to Group" so that others may learn and benefit from your
> issue.
>
> Microsoft engineers can only focus on one issue per thread. Although we
> provide other information for your reference, we recommend you post
> different incidents in different threads to keep the thread clean. In
> doing
> so, it will ensure your issues are resolved in a timely manner.
>
> For urgent issues, you may want to contact Microsoft CSS directly. Please
> check http://support.microsoft.com for regional support phone numbers.
>
> Any input or comments in this thread are highly appreciated.
> ======================================================
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
>
>
>
> --------------------
>>From: "Robert Zahm" <robzahm@hotmail.com>
>>References: <uh$J2l4FGHA.2064@TK2MSFTNGP09.phx.gbl>
> <4#a7CPBGGHA.1240@TK2MSFTNGXA02.phx.gbl>
> <uGxUJWFGGHA.1032@TK2MSFTNGP15.phx.gbl>
> <YCV3R1nGGHA.1240@TK2MSFTNGXA02.phx.gbl>
>>Subject: Re: Errors After Changing Administrator Password
>>Date: Mon, 16 Jan 2006 09:34:31 -0600
>>Lines: 114
>>X-Priority: 3
>>X-MSMail-Priority: Normal
>>X-Newsreader: Microsoft Outlook Express 6.00.2900.2670
>>X-RFC2646: Format=Flowed; Original
>>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670
>>Message-ID: <e5JoZJrGGHA.1180@TK2MSFTNGP09.phx.gbl>
>>Newsgroups: microsoft.public.windows.server.sbs
>>NNTP-Posting-Host: 64-45-168-10.static.cypresscom.net 64.45.168.10
>>Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP09.phx.gbl
>>Xref: TK2MSFTNGXA02.phx.gbl microsoft.public.windows.server.sbs:237013
>>X-Tomcat-NG: microsoft.public.windows.server.sbs
>>
>>Brandy,
>>
>>I don't believe that they key mentioned belongs to the accounting
> software,
>>as they claim to have never heard of it (the popups under DCOM CONFIG are
>>from the accounting software however). I took your suggestion about
> looking
>>for services running as Administrator, and realized that our scanning
>>software, scanrouter, is running with administrative privileges. I can't
>>believe that I hadn't connected the dots until now, but I'm guessing that
>>this was the error (and that no one has used the scanner recently). I
>>changed the password for the account, and will report back tomorrow if the
>>event logs have cleared.
>>
>>Thanks for all of your help!
>>
>>Rob
>>
>

Hello Rob,

Thank you for posting back!

Please take your time to perform the testing. If you have any further
updates, please feel free to let me know.

Incidentally, you can also check the {B2B30542-D976-11D3-B188-0040056AC398}
in the Component Services (DCOMCNFG).

Thanks a lot for your time and I am looking forward to hearing from you
soon!

Best regards,

Brandy Nee

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities...s/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.



--------------------
>From: "Robert Zahm" <robzahm@hotmail.com>
>References: <uh$J2l4FGHA.2064@TK2MSFTNGP09.phx.gbl>
<4#a7CPBGGHA.1240@TK2MSFTNGXA02.phx.gbl>
<uGxUJWFGGHA.1032@TK2MSFTNGP15.phx.gbl>
<YCV3R1nGGHA.1240@TK2MSFTNGXA02.phx.gbl>
<e5JoZJrGGHA.1180@TK2MSFTNGP09.phx.gbl>
<gcUdo2wGGHA.3764@TK2MSFTNGXA02.phx.gbl>
>Subject: Re: Errors After Changing Administrator Password
>Date: Tue, 17 Jan 2006 08:36:51 -0600
>Lines: 149
>X-Priority: 3
>X-MSMail-Priority: Normal
>X-Newsreader: Microsoft Outlook Express 6.00.2900.2670
>X-RFC2646: Format=Flowed; Original
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670
>Message-ID: <ewWw1N3GGHA.1028@TK2MSFTNGP11.phx.gbl>
>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: 64-45-168-10.static.cypresscom.net 64.45.168.10
>Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP11.phx.gbl
>Xref: TK2MSFTNGXA02.phx.gbl microsoft.public.windows.server.sbs:237338
>X-Tomcat-NG: microsoft.public.windows.server.sbs
>
>Brandy,
>
>Changing the password on the service did not resolve the issue. I still
>have a feeling that this "bdmtk" is related to the scanning software, as I
>found one old google reference tying the two together.
>
>I opened up the scanrouter administration utility and was prompted to
change
>a password. After changing the password I am being prompted to restart
the
>machine in order to save the changes. I will do this later today and see
if
>the errors still occur tomorrow.
>
>The event log messages haven't changed from my initial post, every morning
>from 1-2 AM I see the following in the System event log once per second:
>
>Event Type: Error
>Event Source: DCOM
>Event Category: None
>Event ID: 10004
>Date: 1/17/2006
>Time: 1:00:36 AM
>User: N/A
>Computer: BRADFORDDC01
>Description:
>DCOM got error "Logon failure: unknown user name or bad password. " and
was
>unable to logon BRADFORDREALES\ADMINISTRATOR in order to run the server:
>{B2B30542-D976-11D3-B188-0040056AC398}
>
>and the following in the Security event log for the same times:
>
>Event Type: Failure Audit
>Event Source: Security
>Event Category: Logon/Logoff
>Event ID: 529
>Date: 1/17/2006
>Time: 2:00:31 AM
>User: NT AUTHORITY\SYSTEM
>Computer: BRADFORDDC01
>Description:
>Logon Failure:
> Reason: Unknown user name or bad password
> User Name: ADMINISTRATOR
> Domain: BRADFORDREALES
> Logon Type: 4
> Logon Process: DCOMSCM
> Authentication Package: Negotiate
> Workstation Name: BRADFORDDC01
> Caller User Name: BRADFORDDC01$
> Caller Domain: BRADFORDREALES
> Caller Logon ID: (0x0,0x3E7)
> Caller Process ID: 828
> Transited Services: -
> Source Network Address: -
> Source Port: -
>
>The SBS backup is the only other thing running at this time.
>
>Thanks,
>
>Rob
>

Brandy,

Yes, I checked that key in the Component Services...DCOMCNFG, that's how I
found out about BdmTk.

This issue was resolved after changing the password in our scanning
application and restarting the server, there were no errors related to this
in the event logs this morning, thanks for your help and the suggestion
about checking services running as Administrator! Sometimes it's the most
obvious things...

Thanks,

Rob

""Brandy Nee [MSFT]"" <v-branee@online.microsoft.com> wrote in message
news:evvZxoAHGHA.224@TK2MSFTNGXA02.phx.gbl...
> Hello Rob,
>
> Thank you for posting back!
>
> Please take your time to perform the testing. If you have any further
> updates, please feel free to let me know.
>
> Incidentally, you can also check the
> {B2B30542-D976-11D3-B188-0040056AC398}
> in the Component Services (DCOMCNFG).
>
> Thanks a lot for your time and I am looking forward to hearing from you
> soon!
>
> Best regards,
>
> Brandy Nee
>
> Microsoft CSS Online Newsgroup Support
>
> Get Secure! - www.microsoft.com/security
> ======================================================
> This newsgroup only focuses on SBS technical issues. If you have issues
> regarding other Microsoft products, you'd better post in the corresponding
> newsgroups so that they can be resolved in an efficient and timely manner.
> You can locate the newsgroup here:
> http://www.microsoft.com/communities...s/default.aspx
>
> When opening a new thread via the web interface, we recommend you check
> the
> "Notify me of replies" box to receive e-mail notifications when there are
> any updates in your thread. When responding to posts via your newsreader,
> please "Reply to Group" so that others may learn and benefit from your
> issue.
>
> Microsoft engineers can only focus on one issue per thread. Although we
> provide other information for your reference, we recommend you post
> different incidents in different threads to keep the thread clean. In
> doing
> so, it will ensure your issues are resolved in a timely manner.
>
> For urgent issues, you may want to contact Microsoft CSS directly. Please
> check http://support.microsoft.com for regional support phone numbers.
>
> Any input or comments in this thread are highly appreciated.
> ======================================================
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
>
>
>
> --------------------
>>From: "Robert Zahm" <robzahm@hotmail.com>
>>References: <uh$J2l4FGHA.2064@TK2MSFTNGP09.phx.gbl>
> <4#a7CPBGGHA.1240@TK2MSFTNGXA02.phx.gbl>
> <uGxUJWFGGHA.1032@TK2MSFTNGP15.phx.gbl>
> <YCV3R1nGGHA.1240@TK2MSFTNGXA02.phx.gbl>
> <e5JoZJrGGHA.1180@TK2MSFTNGP09.phx.gbl>
> <gcUdo2wGGHA.3764@TK2MSFTNGXA02.phx.gbl>
>>Subject: Re: Errors After Changing Administrator Password
>>Date: Tue, 17 Jan 2006 08:36:51 -0600
>>Lines: 149
>>X-Priority: 3
>>X-MSMail-Priority: Normal
>>X-Newsreader: Microsoft Outlook Express 6.00.2900.2670
>>X-RFC2646: Format=Flowed; Original
>>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670
>>Message-ID: <ewWw1N3GGHA.1028@TK2MSFTNGP11.phx.gbl>
>>Newsgroups: microsoft.public.windows.server.sbs
>>NNTP-Posting-Host: 64-45-168-10.static.cypresscom.net 64.45.168.10
>>Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP11.phx.gbl
>>Xref: TK2MSFTNGXA02.phx.gbl microsoft.public.windows.server.sbs:237338
>>X-Tomcat-NG: microsoft.public.windows.server.sbs
>>
>>Brandy,
>>
>>Changing the password on the service did not resolve the issue. I still
>>have a feeling that this "bdmtk" is related to the scanning software, as I
>>found one old google reference tying the two together.
>>
>>I opened up the scanrouter administration utility and was prompted to
> change
>>a password. After changing the password I am being prompted to restart
> the
>>machine in order to save the changes. I will do this later today and see
> if
>>the errors still occur tomorrow.
>>
>>The event log messages haven't changed from my initial post, every morning
>>from 1-2 AM I see the following in the System event log once per second:
>>
>>Event Type: Error
>>Event Source: DCOM
>>Event Category: None
>>Event ID: 10004
>>Date: 1/17/2006
>>Time: 1:00:36 AM
>>User: N/A
>>Computer: BRADFORDDC01
>>Description:
>>DCOM got error "Logon failure: unknown user name or bad password. " and
> was
>>unable to logon BRADFORDREALES\ADMINISTRATOR in order to run the server:
>>{B2B30542-D976-11D3-B188-0040056AC398}
>>
>>and the following in the Security event log for the same times:
>>
>>Event Type: Failure Audit
>>Event Source: Security
>>Event Category: Logon/Logoff
>>Event ID: 529
>>Date: 1/17/2006
>>Time: 2:00:31 AM
>>User: NT AUTHORITY\SYSTEM
>>Computer: BRADFORDDC01
>>Description:
>>Logon Failure:
>> Reason: Unknown user name or bad password
>> User Name: ADMINISTRATOR
>> Domain: BRADFORDREALES
>> Logon Type: 4
>> Logon Process: DCOMSCM
>> Authentication Package: Negotiate
>> Workstation Name: BRADFORDDC01
>> Caller User Name: BRADFORDDC01$
>> Caller Domain: BRADFORDREALES
>> Caller Logon ID: (0x0,0x3E7)
>> Caller Process ID: 828
>> Transited Services: -
>> Source Network Address: -
>> Source Port: -
>>
>>The SBS backup is the only other thing running at this time.
>>
>>Thanks,
>>
>>Rob
>>
>

Hello Rob,

Thank you for posting back!

I am glad to hear that the issue has being solved!

Here, I found following Documents for you, please see:

Getting Started: Windows Small Business Server 2003 with SP1
http://download.microsoft.com/downlo...f-996d-7b93e09
948ee/GettingStarted_Combined.doc

Windows Small Business Server 2003 Technical FAQ
http://www.microsoft.com/windowsserv...iew/generalfaq.
mspx

Windows Small Business Server 2003 Troubleshooting
http://download.microsoft.com/downlo...5-94ec-4d2d38f
61aa3/TSHT_SBS.htm

It is my pleasure to work with you on this post. If you need any assistance
in the future, please feel free to keep posting back. We are glad to be
working with you again!


Best regards,

Brandy Nee

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities...s/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.



--------------------
>From: "Robert Zahm" <robzahm@hotmail.com>
>References: <uh$J2l4FGHA.2064@TK2MSFTNGP09.phx.gbl>
<4#a7CPBGGHA.1240@TK2MSFTNGXA02.phx.gbl>
<uGxUJWFGGHA.1032@TK2MSFTNGP15.phx.gbl>
<YCV3R1nGGHA.1240@TK2MSFTNGXA02.phx.gbl>
<e5JoZJrGGHA.1180@TK2MSFTNGP09.phx.gbl>
<gcUdo2wGGHA.3764@TK2MSFTNGXA02.phx.gbl>
<ewWw1N3GGHA.1028@TK2MSFTNGP11.phx.gbl>
<evvZxoAHGHA.224@TK2MSFTNGXA02.phx.gbl>
>Subject: Re: Errors After Changing Administrator Password
>Date: Wed, 18 Jan 2006 08:39:22 -0600
>Lines: 158
>X-Priority: 3
>X-MSMail-Priority: Normal
>X-Newsreader: Microsoft Outlook Express 6.00.2900.2670
>X-RFC2646: Format=Flowed; Original
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670
>Message-ID: <#H4O6zDHGHA.2440@TK2MSFTNGP14.phx.gbl>
>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: 64-45-168-10.static.cypresscom.net 64.45.168.10
>Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP14.phx.gbl
>Xref: TK2MSFTNGXA02.phx.gbl microsoft.public.windows.server.sbs:237656
>X-Tomcat-NG: microsoft.public.windows.server.sbs
>
>Brandy,
>
>Yes, I checked that key in the Component Services...DCOMCNFG, that's how I
>found out about BdmTk.
>
>This issue was resolved after changing the password in our scanning
>application and restarting the server, there were no errors related to
this
>in the event logs this morning, thanks for your help and the suggestion
>about checking services running as Administrator! Sometimes it's the most
>obvious things...
>
>Thanks,
>
>Rob
>

[-BaSToS-]

Thank you so much, I had exactly the same problem.

It is caused by a software called "Scan Router V2" wich has a component used to "route" (transfert & sort) scanned document from a all in one network laser copier directly in server's directories.

It is solved now by changing the password in the identity tab of BDmTk COM component as you mentionned.

You are great !