Hello,
So we had an issue on a W2012 server running Hyper-V with 5 virtual machines, that being
that the virtual machine management service was in a stopped state when I logged on hence none of the VM's were running. All I had to do was start it again and everything came back with no issues, but I want to get to the bottom of why this happened to ensure
it does nto happen again.
From Event viewer I see that we had four instances of "Event 10016, DIstibutedCom" and then a further five instances and this corresponds with the VM's going offline, but also from the error you can see that it relates directly to the VMMS as below :
The
application-specific permission settings do not grant Local Launch permission
for the COM Server application with CLSID
{D9E7172C-F462-4CC8-9C80-3B3A00D0D874}
and APPID
{BD168A68-48E8-4AE5-BF4B-CC4F495A0D0F}
to the user NT VIRTUAL MACHINE\518C6C66-296F-449D-A79C-BC2D4B0BBA1C SID
(S-1-5-83-1-1368157286-1151150447-767335591-481954635) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component
Services administrative tool.
With APPID : {BD168A68-48E8-4AE5-BF4B-CC4F495A0D0F} being that Virtual Machine Management
when checking in DCOM Config.
There is no event to say that the VMMS is stopping or stopped after event 10016, as I would
expect to see and there is no common event happening before the two batches of
errors either.
Looking into event 10016 it would appear that the permissions seem to be the issue here and
I need to edit the permissions in the component services admin tool, but when
looking in DCOMConfig the security tab is grey out (probably due to UAC) but I don’t
see why this has happned now with no evniromental changes and why its not
effecting me still?
We do use SCVMM so I am wondering if an event triggered by SCVMM has caused this also ?
Any help appreciated?
Regard’s
Iain