topic Hi Daniel in Network Security

DCOM error 10028 - Sourcefire User Agent

aoun.ameur1 — Tue, 12 Mar 2019 12:56:10 GMT

Hi all

I have a DCOM error in Event viewer linked to sourcefire user agent. It shows that "DCOM was unable to communicate with the computer x.x.x.x using any of the configured protocols". The reference of the error is 10028.

In sourcefire user agent log TAB , it mentionned that :

Is there any suggetsion to resolve this error please ?

Hi

yogdhanu — Thu, 17 Mar 2016 15:34:15 GMT

The message refers to the useragent unable to establish connection and the computer ip is reported. Generally this error occur if the devices being polled are not Windows device. If its windows machine, possible causes is something blocking the DCOM polling.

You can follow this article to grant minimum permission and then check.

Let me know if it helps.

Thanks

Yogesh

Thank's for reply yogdhanu.By

aoun.ameur1 — Fri, 18 Mar 2016 10:56:36 GMT

Thank's for reply yogdhanu.

By following the Grant permission article from cisco.com, the problem was resolved and from logs i no longer see the error . It indicate now "Reported heartbeat from ::1, X.X.X.X to Y.Y.Y.Y."

But, i catched another problem which that the list of users and groups from Users TAB, under Access control Menu, is not up to date, there is many users missing and the access control policy is not applied for present users in the list, when configuring for example an url filtering policy by users.

Hope that I can found a member who had this same problem and can resolve it.

Regards

Hi

yogdhanu — Fri, 18 Mar 2016 11:18:57 GMT

Which version of firepower you are using ? 6.0 or 5.4

If 6.0 ,you would have an option to download the users so they show up in ACP.

Or may be user agent mapping needs to be refreshed by restarting some services in DC.

Thanks

Yogesh

Hi,

aoun.ameur1 — Fri, 18 Mar 2016 13:55:30 GMT

Hi,

I have 5.3.1-6 version, is it required to upgrade or no ?

Thanks

Hi!

peter.atea — Wed, 31 Aug 2016 14:13:13 GMT

Hi!

I'm experience similar problem but we don't have any problems with the Cisco Firepower User Agent.
But the event viewer is filled with DCOM Event ID 10028 events:

Log Name:      System
Source:        Microsoft-Windows-DistributedCOM
Date:          2016-08-31 15:13:19
Event ID:      10009
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      DC01.domain.com
Description:
DCOM was unable to communicate with the computer 10.10.10.21 using any of the configured protocols.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
    <EventID Qualifiers="49152">10009</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2016-08-31T13:13:19.000000000Z" />
    <EventRecordID>2717024</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>DC01.domain.com</Computer>
    <Security />
</System>
<EventData>
    <Data Name="param1">10.10.10.21</Data>
    <Binary>3C5265636F7264233....</Binary>
</EventData>
</Event>

The agent is installed on two DCs, one 20012r2 and one 2008r2, both experience the same problems.

I have checked the firewall settings on the DCs and they seems to be correct according to Microsofts "Setting up a Remote WMI Connection".

Tested the "Grant Minimum Permission to an Active Directory.." troubleshoot but i it did not help, Think this helps if you experince problems with the agent log.

I can connect to some of the clients in the event log (ping and \\IP-address\c$) but not all.

Any ideas how to solve this event errors?

I am also having the same

daniel.cook1 — Tue, 14 Mar 2017 15:45:33 GMT

I am also having the same thing happen. No issues other than event view log filling up with the same error message.

Has anyone found a fix for this?

Hi Daniel

ahk000002 — Wed, 29 Mar 2017 11:52:32 GMT

Hi Daniel

I have the exact same issue as you with only the event log of the server is filling up. I haven't found the cause yet.

Have you in the last 15 days managed to find the cause?

Regards

Re: Hi Daniel

Amafsha1 — Mon, 20 Aug 2018 22:45:43 GMT

I'm having the same issue now as well. What was your resolution?