EdTittel said: View Post
For such folks, the note provides instructions on how to suppress those events in the Event Viewer "by creating a filter and manually editing the filter's XML query." Please consult the Note for detailed instructions. Please also be aware that if you choose to silence these events, you won't be informed if a real, noteworthy DCOM event occurs on your system. If you search these Forums, you can also find other ways to handle these events, too. These include editing the registry to suppress DCOM events completely (subject to the same observation about cutting oneself off from information about real errors), and changing permissions to grant the necessary system components the ability to alter DCOM component data (this is the safest way to prevent those events from recurring, but must be repeated for each feature upgrade that comes along).

For the rest of us -- including me -- we can safely and completely ignore those events. They do not indicate problems or trouble, and occur by deliberate design.


I feel it has to be asked - and I know this thread it's so old that 10 day old sun dried fish would probably have a better aroma but.. I note that these DistributedCom warnings are now warnings and not errors, while that is somewhat better I feel it does not quite go far enough and Microsoft need a category called Info - I.E Informational Only. That I would feel a bit better about. I don't like the thought of blocking any form of DCOM message in case you get one that is genuinely a problem and from my perspective even that they are appearing as a warning it is a problem. Warnings and Errors are something which you should sit up and take notice off. Informational's are just additional information and pretty much throw away unless you are looking for info on why an Error or Warning occurred.
The thing that does concern me about these is that they relate to an unknown SID and people have mentioned that they have tried to delete this SID and it reappears, someone will somehow use this as an attack vector... You know it will eventually happen so don't jinx it by saying it can't :)