From: Hank Arnold on
Hope this helps.

http://eventid.net/display.asp?eventid=10009&eventno=10532&source=Microsoft-Windows-DistributedCOM&phase=1


Regards,
Hank Arnold
Microsoft MVP
Windows Server - Directory Services
http://it.toolbox.com/blogs/personal-pc-assistant/

On 5/10/2010 1:22 AM, NZSchoolTech wrote:
> Good day,
>
> Recently we took out one of our servers in our Active Directory. Since
> it was taken out, in the last few days about 20,000 events of this type
> have been logged in the event log of one of our Domain Controllers. This
> WS2008 DC has most (maybe all) of the FSMO roles assigned to it.
>
> I have no idea where the events are being generated from or what they
> mean or how to stop them. What is happening here?
>
> Log Name: System
> Source: Microsoft-Windows-DistributedCOM
> Date: 8/05/2010 5:40:18 a.m.
> Event ID: 10009
> Task Category: None
> Level: Error
> Keywords: Classic
> User: N/A
> Computer: DC02.hcs.local
> Description:
> DCOM was unable to communicate with the computer GW01 using any of the
> configured protocols.
> Event Xml:
> <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
> <System>
> <Provider Name="Microsoft-Windows-DistributedCOM"
> Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
> <EventID Qualifiers="49152">10009</EventID>
> <Version>0</Version>
> <Level>2</Level>
> <Task>0</Task>
> <Opcode>0</Opcode>
> <Keywords>0x80000000000000</Keywords>
> <TimeCreated SystemTime="2010-05-07T17:40:18.000Z" />
> <EventRecordID>717568</EventRecordID>
> <Correlation />
> <Execution ProcessID="0" ThreadID="0" />
> <Channel>System</Channel>
> <Computer>DC02.hcs.local</Computer>
> <Security />
> </System>
> <EventData>
> <Data Name="param1">GW01</Data>
> </EventData>
> </Event>
>