Thread Info
  • State Verified Answer
  • +5 person also asked this people also asked this
  • Locked Locked
  • Replies 20 replies
  • Answers 3 answers
  • Subscribers 42 subscribers
  • Views 34052 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

STAS DCOM errors 10028 spamming my PDC

JohnHilton

Since installing STAS/XG/interceptX i've noticed my domain computers are taking ages to login. I've disabled interceptX to rule it out (i know this is the authentication group) and had a look at my domain controllers event logs.

I have STAS installed on both my PDC and BDC and configured a per this guide;

How to Implement Clientless SSO with multiple Active Directory Domain Controllers

The event log on my PDC shows the following errors;

 

My BDC-server doesn't have these errors

I 've found a post with a similar issue, however the range of IPs i have an issue with are all NON windows devices. Chromebooks, printers, tablets etc. With the ranges totally different to those set in STAS

Similar issue

Any ideas?

thanks in advance.



This thread was automatically locked due to age.
Parents
  • 0

    Hi John,

    Have you configured the Network IP addresses of these devices in the Monitored Network section of STAS?

    Thanks,

  • 0 in reply to sachingurung

    Hi Thanks for your reply.

    Yes i have on both pdc/bdc.

    The strange thing is however, some of the IP addresses don't fall within the scope of of the defined ;

     

    PDC

     

    BDC

     

     

    ERROR 10028 outside of define IP range;

     

     

    FYI: We use a SOPHOS XG with the managed wifi. The "other" ip addresses in event view that aren't 10.15.20.x match defined wifi network ranges in the DHCP and network sections of the XG for the WIFI. With the exceptions of a couple of the 10.15.20.x that are printers.

    Thanks again

  • +1 in reply to JohnHilton

    Hi John,

    The DCOM error is generated for the IP Address 192.168.60.38 which is not specified in the monitored network. This is a known behavior and the developers are working on a fix. This issue is taken up in the reference ID, NC-27245.

    Thanks,

  • 0 in reply to sachingurung

    Ah ok,

    all my printers which do fall within the range 10.15.20.x also appear as 10028 errors, which i kinda of guess is expected.

    Can i set an "ip exception range" so stas doesn't monitor say 10.15.20.10 to 10.15.20.100 in a monitored range of 10.15.20.1/22 ?

    I'm having issues with the log in speed of my domain computers, i thought that maybe the 10028 errors generated in the event log was causing a latency issue on my domain controller.

    Will the issue you say the developers are fixing currently have a negative performance impact on my domain controllers?

    i just need to rule out that dcom 10028 errors are the reason my domain computers are logging in slow.

     

    cheers

  • +1 in reply to JohnHilton

    The issue is not completely caused due to STAS but when STAS is queried by the access_server. When unknown traffic is generated, access_server reads it and sends a workstation polling request to STAS. STAS tries to map the IP address with the logged in User which fails, due to this a WMI request is made to these IP addresses, which also fails. Which results in a DCOM error. This information can be read in the KB article here, read the point 6,7 and 8 in How STAS works section. 

    Thanks

  • 0 in reply to sachingurung

    Sorry forgot to ask,

    What the eta of the fix? and where can i view the current issues that the engineers are looking at?

    Thanks again

  • 0 in reply to sachingurung

    Is something new with this problem? when wil be fix it? thanks

Reply Children
No Data