Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Question
Saturday, October 13, 2018 12:25 PM | 3 votes
I have a clean installed 1809 and I found this error in system log. This happened when windows start up. I can't find anything about the "coredpussvr.exe" on the internet. Anyone known something about this?
Unable to start a DCOM Server: {417976B7-917D-4F1E-8F14-C18FCCB0B3A8}. The error:
"0"
Happened while starting this command:
C:\Windows\System32\coredpussvr.exe -Embedding
- System
- Provider
[ Name] Microsoft-Windows-DistributedCOM
[ Guid] {1B562E86-B7AA-4131-BADC-B6F3A001407E}
[ EventSourceName] DCOM
- EventID 10000
[ Qualifiers] 0
Version 0
Level 2
Task 0
Opcode 0
Keywords 0x8080000000000000
- TimeCreated
[ SystemTime] 2018-10-13T12:00:55.320022300Z
EventRecordID 4841
Correlation
- Execution
[ ProcessID] 936
[ ThreadID] 5068
Channel System
Computer PC
- Security
[ UserID] S-1-5-21-599283697-879280032-2591280124-1001
- EventData
param1 C:\Windows\System32\coredpussvr.exe -Embedding
param2 0
param3 {417976B7-917D-4F1E-8F14-C18FCCB0B3A8}
All replies (13)
Saturday, October 13, 2018 5:24 PM
Using the strings utility against coredpus.dll I found these below. It appears that these files are related to mobile device enrollment. But like you, I could not anything of value doing a search. I would think that you could safely ignore those events. If you start seeing a lot of them, then you might want to use process monitor to see if you can figure out what is trying to call it.
oftware\Microsoft\Provisioning\OMADM\Logger
OSData\Software\Microsoft\Provisioning\OMADM\Logger
Software\Microsoft\Enrollments
OSData\Software\Microsoft\Enrollments
Software\Microsoft\Enrollments\
OSData\Software\Microsoft\Enrollments\
EnrollmentState
EnrollmentType
Monday, October 15, 2018 3:12 AM
Hi,
There are three main reasons results in the problem:
1.NTFS permissions are not setup properly.
2.The application or service is looking for a short file name or long file name.
3.Bug in the 3rd party or custom application.
So it is suggested that you can perform a clean boot to disable the third-party conflict.
In addition, you can follow the reference to check the permission of the dcom.
http://www.itprotoday.com/management-mobility/use-dcomcnfgexe-stop-dcom-10000-and-10005-errors
https://stackoverflow.com/questions/12974576/what-do-the-different-dcom-com-security-settings-mean
Note: this is a 3rd party link, we don't have any warranties on this website. It's just for your convenience.
Best Regards,
Tao
Please remember to mark the replies as answers if they help. If you have feedback for TechNet Subscriber Support, contact [email protected].
Friday, November 9, 2018 9:42 AM
Same problem.
1.NTFS permissions are not setup properly.
2.The application or service is looking for a short file name or long file name.
3.Bug in the 3rd party or custom application.
- this problems my be for any problem in windows, but C:\Windows\System32\coredpussvr.exe -Embedding with 0 appair after clear installation and all update in windows 10 corp
Saturday, December 15, 2018 9:40 AM
ID belongs to : ProvisioningWapDPURemote
Its is beyond me why would such a service be called to start on a desktop machine, is this some sort of thingie that belongs to metered connections in windows 10 maybe?. At least WAPprovisioning would hint to something like that...but in Windows 10 dev speak WAP is also Windows Azure Pack.... and google doesnt even know the term ProvisioningWapDPURemote which is interesting and somehow mind boggling.
MicrosoftLauncher installed as front end on my android phone and linking android phone to windows 10 wouldnt cause this or would it?
(dont ask me why this editor changes font sizes all by itself when using backspace to retract a line)
Friday, January 18, 2019 11:39 PM | 1 vote
Hi,
There are three main reasons results in the problem:
1.NTFS permissions are not setup properly.
2.The application or service is looking for a short file name or long file name.
3.Bug in the 3rd party or custom application.
I created a new Hyper-V VM, and installed Windows 10 v1809 from the Microsoft ISO. I have the same problem.
- If the NTFS permissions are not setup properly, then Microsoft set it that way out-of-the-box. I've done nothing more than install Windows.
- The "application or service" looking the wrong file name is, again, something Microsoft has done wrong.
- No software installed.
I have installed all available Windows updates.
Any ideas on how to prevent this error?
-Tony
Saturday, January 19, 2019 1:19 PM
Do you see just one error or do you see lots of them? How often does it occur? Only after a reboot or at other times.
When you see the event try to track down the process and user in your event. (I took this from the original question)
[ ProcessID] 936
[ UserID] S-1-5-21-599283697-879280032-2591280124-1001
Open an admin command prompt and run these commands. You will need to download psgetsid from sysinternals.com. Hopefully this will give us more information about what is causing the event.
tasklist -v | findstr 936
tasklist -svc | findstr 936
psgetsid S-1-5-21-599283697-879280032-2591280124-1001
Thursday, January 24, 2019 9:34 AM
Unable to start a DCOM Server: {417976B7-917D-4F1E-8F14-C18FCCB0B3A8}. The error: "0" Happened while starting this command: C:\Windows\System32\coredpussvr.exe -Embedding
I got the same error.
Do you see just one error or do you see lots of them? How often does it occur?
I got this error every hour.
tasklist -v | findstr 936
This returns:
tasklist -v | findstr <processID>
svchost.exe <processID> Services 0 30.332 K Unknown NT-AUTORITÄT\SYSTEM 0:00:10 not applicable
tasklist -svc | findstr 936
This returns:
tasklist -svc | findstr <processID>
svchost.exe <processID> BrokerInfrastructure, DcomLaunch, Power,
psgetsid S-1-5-21-599283697-879280032-2591280124-1001
The UserID (differs on my system) belongs to the active user account in my case.
- Gruß Florian
Thursday, January 24, 2019 7:10 PM
Look for a schedule task that runs every hour. Here is a Powershell command to look at all tasks and sort by NextRunTime. Run Powershell as an administrator.
Get-ScheduledTask | Get-ScheduledTaskInfo | Select-Object -Property nextruntime, taskname, taskpath |where-object {$_.nextruntime -ne $null} | Sort-Object -Property nextruntime
Friday, January 25, 2019 8:16 AM
Thanks for this idea, MotoX80. I already checked for matching scheduled tasks, did not find one. Tried again with the powershell command you provided, there were two with matching run time (on the first run), but one is inactive and the other one does not cause the error (tested it by force a run). Running it an hour later there were no run times matching the error.
- Gruß Florian
Saturday, January 26, 2019 12:07 AM
Well now it gets tougher. The only way that I know how to find the caller is to run Process Monitor. https://docs.microsoft.com/en-us/sysinternals/downloads/procmon
Have you ever used that? It will trace all registry, file I/O, and network calls that occur on your system. The volume of information can be massive. You have to try to find the DCOM event and then work backwards and try to find what process initiated the call. You can use the filter options to exclude processes that you have high confidence did not initiate the call. Like explorer.exe. Give that a try and see if you can find anything.
Another option would be to stop services one by one and if the events also stop. 3rd party stuff like HP, Dell, Google, Adobe, etc...
Thursday, April 11, 2019 3:41 AM | 2 votes
ive had this issue too and decided to use process monitor as advised.in my case since it was every hour at the same time i found it easily and the process thread seems to have been caused by the windows store.
i found in the windows store log in event viewer (application and services logs--windows--store--operational)
the following error at the same time
Log Name: Microsoft-Windows-Store/Operational
Source: Windows-ApplicationModel-Store-SDK
Date: 10/04/2019 22:38:19
Event ID: 1
Task Category: StorefrontClient
Level: Error
Keywords: (1)
User: METALSPIDER-PC\metalspider
Computer: metalspider-pc
Description:
DMProcessConfigXMLFiltered returned an error -2147024809 for wapDocument <wap-provisioningdoc>
<characteristic type="Policy" scope="user">
<characteristic type="Result">
<characteristic type="ApplicationManagement">
<parm-query name="RequirePrivateStoreOnly"/>
</characteristic>
</characteristic>
</characteristic>
</wap-provisioningdoc> with resultsDoc =
Error Code: Unknown HResult Error code: 0x80000000
Function: DMProcessConfigXMLFiltered
Source: C:\BA\26\s\src\Core\Helpers\NativeMethods.cs (355)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Windows-ApplicationModel-Store-SDK" Guid="{ff79a477-c45f-4a52-8ae0-2b324346d4e4}" />
<EventID>1</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>1</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000001</Keywords>
<TimeCreated SystemTime="2019-04-10T19:38:19.664101400Z" />
<EventRecordID>72397</EventRecordID>
<Correlation />
<Execution ProcessID="1536" ThreadID="7084" />
<Channel>Microsoft-Windows-Store/Operational</Channel>
<Computer>metalspider-pc</Computer>
<Security UserID="S-1-5-21-3405906195-82153394-3421685626-1001" />
</System>
<EventData>
<Data Name="Message">DMProcessConfigXMLFiltered returned an error -2147024809 for wapDocument <wap-provisioningdoc>
<characteristic type="Policy" scope="user">
<characteristic type="Result">
<characteristic type="ApplicationManagement">
<parm-query name="RequirePrivateStoreOnly"/>
</characteristic>
</characteristic>
</characteristic>
</wap-provisioningdoc> with resultsDoc = </Data>
<Data Name="Line Number">355</Data>
<Data Name="File Name">C:\BA\26\s\src\Core\Helpers\NativeMethods.cs</Data>
<Data Name="Function">DMProcessConfigXMLFiltered</Data>
<Data Name="Error Code">-2147483648</Data>
</EventData>
</Event>
searching for "RequirePrivateStoreOnly" i found there is a known issue from older builds with the gpo and windows store in windows 10 enterprise.
i also seemed to be able to trigger the error by manually checking for updates for apps in the windows store so i think this is what is triggering the process thread and causing the error every hour.
a friend of mine using windows 10 pro told me he has no such errors so i decided to get a win 10 pro key and install it on my pc.ever since downgrading to win 10 pro i no longer seem to be getting the store error or the error in the system log for coredpussvr.exe -Embedding
are you using windows 10 enterprise?
Friday, April 26, 2019 8:34 AM
are you using windows 10 enterprise?
yes, and also have the same issue
Saturday, April 27, 2019 11:14 AM
well 2 and a half weeks since i have "downgraded" to windows 10 pro and i havent had this error even once.
so for me this seems like a good solution since im using this on my home pc.