STAS DCOM errors 10028 spamming my PDC

Hi John,

Have you configured the Network IP addresses of these devices in the Monitored Network section of STAS?

Thanks,

Hi Thanks for your reply.

Yes i have on both pdc/bdc.

The strange thing is however, some of the IP addresses don't fall within the scope of of the defined ;

PDC

BDC

ERROR 10028 outside of define IP range;

FYI: We use a SOPHOS XG with the managed wifi. The "other" ip addresses in event view that aren't 10.15.20.x match defined wifi network ranges in the DHCP and network sections of the XG for the WIFI. With the exceptions of a couple of the 10.15.20.x that are printers.

Thanks again

Hi Thanks for your reply.

Yes i have on both pdc/bdc.

The strange thing is however, some of the IP addresses don't fall within the scope of of the defined ;

PDC

BDC

ERROR 10028 outside of define IP range;

FYI: We use a SOPHOS XG with the managed wifi. The "other" ip addresses in event view that aren't 10.15.20.x match defined wifi network ranges in the DHCP and network sections of the XG for the WIFI. With the exceptions of a couple of the 10.15.20.x that are printers.

Thanks again

Hi John,

The DCOM error is generated for the IP Address 192.168.60.38 which is not specified in the monitored network. This is a known behavior and the developers are working on a fix. This issue is taken up in the reference ID, NC-27245.

Thanks,

Ah ok,

all my printers which do fall within the range 10.15.20.x also appear as 10028 errors, which i kinda of guess is expected.

Can i set an "ip exception range" so stas doesn't monitor say 10.15.20.10 to 10.15.20.100 in a monitored range of 10.15.20.1/22 ?

I'm having issues with the log in speed of my domain computers, i thought that maybe the 10028 errors generated in the event log was causing a latency issue on my domain controller.

Will the issue you say the developers are fixing currently have a negative performance impact on my domain controllers?

i just need to rule out that dcom 10028 errors are the reason my domain computers are logging in slow.

cheers

The issue is not completely caused due to STAS but when STAS is queried by the access_server. When unknown traffic is generated, access_server reads it and sends a workstation polling request to STAS. STAS tries to map the IP address with the logged in User which fails, due to this a WMI request is made to these IP addresses, which also fails. Which results in a DCOM error. This information can be read in the KB article here, read the point 6,7 and 8 in How STAS works section. 

Thanks

Sorry forgot to ask,

What the eta of the fix? and where can i view the current issues that the engineers are looking at?

Thanks again

Is something new with this problem? when wil be fix it? thanks

Hi Sachingurung,

when will this be fixed?

I can not find this NC-27245 fix in any release notes

Are you also fixing the Logoff detection in STAS?

I'd also like to know an ETA for this. The event logs are full with this and it's really annoying when troubleshooting other issues and trying to review the event log.

Any new ideas or fixes yet?

We are also seeing hundreds of 10028 dcom errors in server 2016 where we have installed the STAS.

kindly share ETA when this will going to sort?

I support 3 sites and since moving to Sophos AV & XG, each one has hundreds of these error referring STAS. It's filling up EV making it a task to spot other issues. It would seem that this problem has been known about for a very long time and a solution is long overdue.

But I guess once they've got your money ........................