RE: FIX: EventSystem 4609 errors after installing XP SP2


Go Back   Computer Help Articles > Windows XP Security Admin
User Name
Password
FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
Thread Tools Search this Thread Display Modes
  #1  
Old 01-05-2006, 04:16 AM
Christopher Hill
 
Posts: n/a
Default RE: FIX: EventSystem 4609 errors after installing XP SP2

Microsoft Knowledge Base article 909444 has been release recently which may
also help with this problem when the HRESULT is 80070005.

If you have changed the default security permissions on your %systemdrive%
root (usually C or on %windir%\registration, you may experience this error.
Under XP SP2 the permissions on %systemdrive% were modified to add
'Everyone/Read and Execute/This folder only' and if organisations change the
%systemdrive% permissions for other reasons (through Group Policy or another
method) they may not be aware of this change.

To reset the permissions on %systemdrive% on a computer, run this command:

%WINDIR%\System32\secedit.exe /configure /db
%windir%\security\Database\rootsec.sdb /cfg
%windir%\security\templates\rootsec.inf

Also check that the permissions on %windir\registration are set as per the
knowledge base article above.
--
'Therefore, if anyone is in Christ, he is a new creation;
the old has gone, the new has come!' - 2 Corinthians 5v17


"Christopher Hill" wrote:

> As a followup to my own post, if the suggestion I made below doesn't help,
> you can also try the workaround posted at TechRepublic here:
>
> http://techrepublic.com.com/5138-10877_11-5657162.html
>
> When is this problem going to be at least acknowledged on the Knowledge
> Base, and a fix provided?!?
>
> "Christopher Hill" wrote:
>
> > Hi,
> >
> > I've been seeing a particular problem on certain Windows XP computers when
> > they are updated to Service Pack 2, and judging from posts in these
> > newsgroups and also on other Internet message boards, it's quite a common
> > problem. The symptoms are that after SP2 has been installed, and the machine
> > has been rebooted a few times, the following error message occurs in the
> > Application Event Log:
> >
> > Event Type: Error
> > Event Source: EventSystem
> > Event Category: (50)
> > Event ID: 4609
> > Date: 10/06/2005
> > Time: 10:40:23
> > User: N/A
> > Computer: HISAD
> > Description:
> > The COM+ Event System detected a bad return code during its internal
> > processing. HRESULT was 80070005 from line 44 of
> > d:\qxp_slp\com\com1x\src\events\tier1\eventsystemo bj.cpp. Please contact
> > Microsoft Product Support Services to report this error.
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> >
> > Some errors may be slightly different:
> >
> > Event Type: Error
> > Event Source: EventSystem
> > Event Category: (50)
> > Event ID: 4609
> > Date: 10/06/2005
> > Time: 09:30:35
> > User: N/A
> > Computer: HISAD
> > Description:
> > The COM+ Event System detected a bad return code during its internal
> > processing. HRESULT was 80080005 from line 44 of
> > d:\qxp_slp\com\com1x\src\events\tier1\eventsystemo bj.cpp. Please contact
> > Microsoft Product Support Services to report this error.
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> >
> > and at the same time errors similar to the following (sometimes with a
> > different GUID number) may occur in the System event log:
> >
> > Event Type: Error
> > Event Source: DCOM
> > Event Category: None
> > Event ID: 10010
> > Date: 10/06/2005
> > Time: 09:53:34
> > User: NT AUTHORITY\SYSTEM
> > Computer: HISAD
> > Description:
> > The server {8BC3F05E-D86B-11D0-A075-00C04FB68820} did not register with DCOM
> > within the required timeout.
> >
> > For more information, see Help and Support Center at
> > http://go.microsoft.com/fwlink/events.asp.
> >
> > I ummed and ahhed over this problem for a while, and eventually found the
> > following two articles relating to Windows 2000 Service Pack 4:
> >
> > Overview of the "Impersonate a Client After Authentication" and the "Create
> > Global Objects" Security Settings (821546.KB.EN-US.2.2)
> > http://support.microsoft.com/?kbid=821546
> >
> > Local Security Policy Values May Revert to the Values That Are Stored in
> > SecEdit.sdb After You Install Windows 2000 Service Pack 4
> > http://support.microsoft.com/?kbid=827664
> >
> > It turns out that in Windows 2000 Service Pack 4 two new user rights were
> > added, "Impersonate a client after authentication" (SeImpersonatePrivilege)
> > and "Create Global Objects" (SeCreateGlobalPrivilege).
> >
> > Even though the articles don't say so, it seems that they were also added in
> > Windows XP Service Pack 2.
> >
> > However, it seems that *sometimes* something goes wrong in the XP SP2
> > installer when it sets up these two new user rights. I think this is why some
> > computers get the above error messages. It doesn't happen all the time, and I
> > can't see any rhyme or reason to which computers get messed up and which ones
> > don't. I reckon it's a race condition or some other similar bug in the
> > installer.
> >
> > The reason that the problem doesn't always manifest itself straight away is
> > probably because by default Windows only 'refreshes' its security settings
> > every 16 hours, and if that refresh is a while away you might not see the
> > problem for a while. Some networks may also have turned up this refresh time,
> > so the problem is even worse.
> >
> > Some sites may also have these settings set (possibly incorrectly) in their
> > Default Domain Policy group policy, which could also mess things up. However,
> > at my site we don't have these settings set on the domain anywhere, only in
> > the Local Security Settings, and yet we still have the problem.
> >
> > Anyway, if the security settings upgrade goes wrong, you end up with the
> > error. Fortunately, it seems to be quite easy to fix:
> >
> > On the affected workstation:
> > 1) Go to Start/Settings/Control Panel/Administrative Tools
> > 2) Run 'Local Security Policy'
> > 3) Go to Security Settings/Local Policies/User Rights Assignments
> > 4) Double click on 'Create global objects'.
> > The correct default settings are 'Administrators', 'INTERACTIVE' and
> > 'SERVICE'.
> > 5) Double click on 'Impersonate a client after authentication'.
> > The correct default settings are 'Administrators', 'ASPNET' (if you have
> > the .NET framework installed) and 'SERVICE'
> >
> > Even if the settings are set correctly, you may need to 'refresh' them to
> > fix the problem.
> > To do this, on each policy, remove one of the entries ('SERVICE' is probably
> > the best to remove), then press OK to save the changes, and then go back in
> > and add it back in again (click 'Add User or Group...', type 'SERVICE' into
> > the white box, and press OK).
> >
> > Then close the Local Security Settings box and reboot. If you are running in
> > a domain with Group Policy you might want to force a group policy refresh
> > before you reboot by running 'gpupdate /force'.
> >
> > I hope this helps some people!
> >
> > Regards,
> >
> > Chris
> >

Reply With Quote
Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Drive Errors each time I boot up Windows XP Mark H Windows XP Accessibility 2 01-05-2006 08:08 AM
Cpu is messed up star creen is jummbled have the following errors Max10 Windows XP Help and Support 0 01-05-2006 02:51 AM
Errors Installing iTunes... PLEASE HELP!!! BrentSzabad Windows XP Help and Support 2 01-05-2006 02:43 AM
CD-RW large file read errors after installing 120GB HDD Stefan Windows XP Hardware 3 01-05-2006 02:20 AM
Re: device driver error and ram errors again!! Rob Windows XP Hardware 0 01-05-2006 02:16 AM


All times are GMT. The time now is 06:03 PM.


Powered by vBulletin Version 3.5.2
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd. SEO by vBSEO 2.3.2 © 2005, Crawlability, Inc.

RE: FIX: EventSystem 4609 errors after installing XP SP2