Fix DCOM Event 10005 with Powershell

Do you get these events in your system log?

The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. attempting to start the service ntmssvc with arguments “-Service” in order to run the server:
{D61A27C6-8F53-11D0-BFA0-00A024151983}

Symantec explains this is caused by disabling the Removable Storage Manager and provides a solution.

Removing those registry keys on a bunch of servers manually is a pain. Modifying DCOM settings even more so. So I explored fixing this with Powershell.


Scripting DCOM application settings (COM+ Apllications in dcomcnfg) is doable. See MSDN. However, scripting the DCOM Config section of dcomcnfg appears to be impossible. Turns out all these settings are located in the registry. Clearing the checkbox “Run application on this computer” does nothing more then rename one of the values in the registry key you will delete. That’s one problem down.
So all we have to do is remove the appropriate registry keys on all our affected servers. Remote registry manipulation is something we have done before, so let’s jump to the script! In order to be able to undo the changes you will make with this script, I recommend you export the following keys on one of your servers:

HKLM\Software\Classes\AppID\{D61A27C1-8F53-11D0-BFA0-00A024151983}
HKLM\Software\Classes\CLSID\{D61A27C6-8F53-11D0-BFA0-00A024151983}

Here’s the script:

function Fix-RsmDcom
{
	Param($ServerName = 'blank')
 
	If ($ServerName -eq 'blank')
	{
		$ServerName = Read-Host "ServerName"
	}
 
	$Hive = 'LocalMachine'
	$AppIDKeyName = "Software\Classes\AppID"
	$AppIDSubKey = "{D61A27C1-8F53-11D0-BFA0-00A024151983}"
	$CLSIDKeyName = "Software\Classes\CLSID"
	$CLSIDSubKey = "{D61A27C6-8F53-11D0-BFA0-00A024151983}"
	$Writable = $true
 
	Write	-Host "Processing Server $Servername"
 
	$Registry = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey([Microsoft.Win32.RegistryHive]::$Hive, $ServerName)
	If ($Registry)
	{
		$AppID = $Registry.OpenSubKey($AppIDKeyName, $Writable)
		If ($AppID)
		{
			If ($AppID.GetSubKeyNames() -contains $AppIDSubKey)
			{
				Write-Host "`tRemoving AppID subkey"
				$AppID.DeleteSubKey($AppIDSubKey)
			}
			Else
			{
				Write-Warning "AppID SubKey not found on $ServerName"
			}
		}
		Else
		{
			Write-Warning "Failed to open AppID subkey on $ServerName"
		}
 
		$CLSID = $Registry.OpenSubKey($CLSIDKeyName, $Writable)
		If ($CLSID)
		{
			If ($CLSID.GetSubKeyNames() -contains $CLSIDSubKey)
			{
				Write-Host "`tRemoving CSLID subkey tree"
				$CLSID.DeleteSubKeyTree($CLSIDSubKey)
			}
			Else
			{
				Write-Warning "CLSID SubKey not found on $ServerName"
			}
		}
		Else
		{
			Write-Warning "Failed to open CLSID subkey on $ServerName"
		}
	}
	Else
	{
		Write-Warning "Failed to connect to registry on $ServerName"
	}
}

Download it here: Fix-RsmDcom (rename to .ps1)

Enjoy!

»crosslinked«

Leave a Reply