DCOM error

Just got the following error in the event log on XP (SP3):

Source: DCOM
EventID: 10000
User: NT AUTHORITY\NETWORK SERVICE
Description: Unable to start a DCOM Server:
{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}.
The error: "Access is denied. "
Happened while starting this command:
C:\WINDOWS\system32\wbem\wmiprvse.exe -secured -Embedding

My suspicion was immediately, that my hardlinking of identical files on the system drive caused the problem. Hardlinking is a fine thing, but the hardlink will contain the ACL (file permissions) of one of the originating files (depending on the method used). So both instances of the file would receive the same ACL, even if one of them was more restrictive than the other. Hence I was looking for a permission problem.

Looking at the permissions of wmiprvse.exe, it turned out that the hardlinking process had screwed up the inheritance. So the network service (built-in) account did not have the right to execute that particular binary. What to do? Well, nothing easier than that, I took the containing folder and told it to reset permissions on all child elements. Voila, problem solved.

Since the permission problems may be more far-reaching, I decided to follow the instructions here to reset all the file permissions.

// Oliver

PS: for hardlinking I used DFHL in order to save space for the VM. As I said, I knew about the risk and decided to take it. Just be aware of it and don’t take the risk if you can’t judge the consequences …