Failed to start service WMS - Error Id 1010

**pdoth** · 27 Jan 2018

Funny you should mention the famous (or infamous more like it) DCOM error. I'm assuming you are referring to this one:

ID 10010 - "The server {784E29F4-5EBE-4279-9948-1E8FE941646D} did not register with DCOM within the required timeout."

ID 10016 - "The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool."

Been there, done that, still got it.......... I think. Problem is, with this new error currently recording over 7,700 events its hard to find it mentioned anywhere in the log.

I wonder if there is a connection? The 'problem' is as I see it, it can't be right for this situation to just continue ad infinitum. It makes checking the Event log virtually impossible. With the number of machines running Windows world wide I still find it unbelievable that only 2 users are reporting this, plus, an error code reported which is not correct.

Perhaps you are right. The best approach maybe to just give in and start again. I'm busily backing up everything I can find prior to a fresh start. I have tried a new UAC, no change.

I will keep this thread open for the time being, just in case, and will update as and when there is any change.

Thanks for all your help this far............. you never know :)

**EdTittel** · 27 Jan 2018

I would try an in-place upgrade repair install, before taking the clean install route. Something bizarre (and apparently neither totally unique nor completely endemic) is going on. I wish I could offer more insight, but this one's going to take some work to puzzle through. Please keep us posted.
Thanks,
--Ed--

**Eagle51** · 27 Jan 2018

Not sure if you guys have seen the following links or if it's applicable to your issue, but might be worth looking into. This stuff looks pretty involved, so please do your homework on it :)

WMI: Missing or Failing WMI Providers or Invalid WMI Class | Ask the Performance Team Blog

WMI: Repository Corruption, or Not? | Ask the Performance Team Blog

**EdTittel** · 28 Jan 2018

Zounds! No kidding about the homework, Eagle51. Nice find, though. Thanks for sharing!
--Ed--

**indianacarnie** · 28 Jan 2018

Have you gotten rid of that netmon.exe yet? That COULD be the source of your problem. You did say they were in the same folder , correct? Here's what I found about it :
"netmon.exe is a process which is registered mass-mailing worm. "This virus is distributed via the Internet through e-mail and comes in the form of an e-mail message, in the hopes that you open its hostile attachment. ". The worm has it's own SMTP mailing engine which means it gathers E-mails from your local computer and re-distributes itself." (Oh, that's from process library btw.)

A very thorough Virus scan may aid you.

**pdoth** · 29 Jan 2018

Oh, Oh, that was something I didn't want to hear. When I looked this up originally I thought it was:

"A packet analyzer from Microsoft, NetMon.exe tracks packets sent and received through a Windows network. It is used for troubleshooting issues and routing problems. In 2014, Microsoft replaced Network Monitor with Microsoft Message Analyzer. Founded in 1975, Microsoft's flagship product is the Windows operating system, which is installed on over 90% of workstations worldwide."

Before I say any more I had better go and do some more homework on it.

Where did you get this from

indianacarnie

**pdoth** · 29 Jan 2018

Something definitely screwy going on here. I tried Eagle51's suggestion but got back a - "this file does not exist" from the results. I wonder if things have changed since it was written in 2014?

Since my last post I have been trying a few things out which "appear" to have altered the situation. Following indianacarnie's pointer I looked again at the netmon.exe file at C/Windows/wmi. I have always "felt" this was somehow peculiar so, I changed the name and re-booted. Low and behold, no error messages. Not surprising really I suppose as what ever was calling it could now no longer find it, but, you would have thought even this would have produced another error message by it self? Oh, but I do have the DCOM error back !

I have also been looking at my other systems which is pretty much identical to my main one apart from the amount of software installed.

There is another difference though, this pc does not have the latest update KB4056892 (cumulative update for v1709) installed. To my surprise it also does not have a C/Windows/wmi file present. So, I am in the process of downloading and installing this and will see if the missing file magically appears (also of course if the error appears along with it).

In the meantime I am continuing to run with the netmon file renamed and will be looking for any issues as a result.

**indianacarnie** · 29 Jan 2018

pdoth said:

Where did you get this from

indianacarnie

From Process Library, they're usually pretty good. Been using them for information for years.

netmon.exe - What is netmon.exe?

**pdoth** · 30 Jan 2018

Thanks for the info @indianacarnie. To be on the safe side I have left this file renamed for the time being. So far there does not appear to be any side effects of doing that except for the fact of no more event errors showing up. If after a week or so it stays like that I will delete it.

Still left with loads of questions but at least I can now sleep better.

**indianacarnie** · 30 Jan 2018

You're very welcome! And hey,........ a better nights sleep is always good

Think your renaming is a good idea and I do recommend Process Library btw.

Failed to start service WMS - Error Id 1010

Posting Permissions