DCOM Errors in Event Viewer (SCCM)
I noticed in a recent SCCM environment that the SCCM server was rebooting every 20-30 minutes. Looking at the event viewer, I saw where SCCM was receiving DCOM errors by the hundreds during this time. This also caused RPC issues which in turn caused the system to reboot.
The description for Event ID 10009 from source Microsoft-Windows-DistributedCOM cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event:
SCCM client COMPUTER NAME HERE
When doing an Active Directory scan from SCCM, there were over 1000 clients whose computer accounts were not disabled and no longer existed on the network. Because I had the client push enabled, SCCM was trying to push to these computers, but could not which caused the generation of several hundred DCOM errors during a short period of time. This also caused the RPC errors. If there are RPC errors, the RPC process is set to reboot the machine (windows 2008 r2) and this option cannot be changed.
Go to the <Microsoft Configuration Manager>\inboxes\ccrretry.box folder. You may see several files in this folder. This is where SCCM is trying to install the client and has failed. The retry period is every hour for 7 days. To stop the retry and thus stop the DCOM errors you can select these files and delete them. If you go back into the event viewer, you should no longer see the DCOM error coming in.