MSDTC Error after applying W2K3 SP2

[Paul Prewett]

Hi -

I have 4 webservers in my webfarm. All Win2k3 web edition. Before
yesterday, none of them were service packed. I have now applied SP2 to two
of them, and I'm getting a very weird MSDTC error on them now.

The error occurs when I attempt a series of SQL statements wrapped in a
TransactionScope(). It's executing against a different server, so this is
where it's elevated to a distributed transaction.

The error is:
System.UnauthorizedAccessException: Access is denied. (Exception from
HRESULT: 0x80070005 (E_ACCESSDENIED))

And the stack trace ends here:
System.Transactions.Oletx.IDtcProxyShimFactory.ConnectToProxy(.....

I've checked and double checked all my MSDTC settings, and they're set
properly. I have SP2 running elsewhere on different networks using MSDTC and
the settings are identical.

A DTCPing test shows that everything is OK in both directions.

I'm 100% sure it's not my database server because the other two machines
that aren't SP'd are still executing DT's just fine.

I found this post:
https://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=1974418&SiteID=1

So I ran "sc sdshow mstdc" on the machine where I'm receiving the error and
got this output:

DA;;CCLCSWRPLOCRRC;;;S-1-2-0)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;CCLCSWRPRC;;;WD)(A;;CCLCSWRPLORC;;;NS)SAU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

I can't really tell whether that's right or not, though. Can anyone comment
on that?

I have the same problem on both machines where SP2 has been applied.

Any help would be greatly appreciated.

Thanks,

 

[Steven Cheng [MSFT]]

Hi Paul,

Regarding on the MSDTC access denied error, I've performed some research
and found that such error is likely due to the default system registraction
permission has been changed. The service pack maybe installed maybe the
potential cause. The forum thread you referenced mentioned checking the
access control setting(the SACL string ). Here is anther kb article you can
also have a look which contains some more information about the security
setting and adjustment:

#Systems that have changed the default Access Control List permissions on
the %windir%\registration directory may experience various problems after
you install the Microsoft Security Bulletin MS05-051 for COM+ and MS DTC
http://support.microsoft.com/kb/909444

You can also check the system eventlog to see whether there is any useful
info there. Though I'm not expert on MSDTC /COM+, I can help you check for
some former or exsting issues. Please feel free to post here if you have
any new finding.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead


Delighting our customers is our #1 priority. We welcome your comments and
suggestions about how we can improve the support we provide to you. Please
feel free to let my manager know what you think of the level of service
provided. You can send feedback directly to my manager at:
(e-mail address removed).

==================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.
==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.



--------------------

 

[Paul Prewett]

Thanks, Steven.

I reviewed the article and after setting the permissions (they were already
there under the Advanced settings, but I set them on the main just in case)
and restarting, the problem persists.

There are no event log entries that relate to this error except the one
logged from ASP.NET in the App log, which provides no additional information
(I should have mentioned that in the original post).

On Florin Lazar's recommendation, I have posted the problem over in the
Transactions forums, which he says is monitored by the Transactions team
daily. I hope to make more progress there.

http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=3171653&SiteID=1

Of course, if you have any additional ideas, I'm all ears and appreciate
your help.


--
-Paul Prewett

Hi Paul,

Regarding on the MSDTC access denied error, I've performed some research
and found that such error is likely due to the default system registraction
permission has been changed. The service pack maybe installed maybe the
potential cause. The forum thread you referenced mentioned checking the
access control setting(the SACL string ). Here is anther kb article you can
also have a look which contains some more information about the security
setting and adjustment:

#Systems that have changed the default Access Control List permissions on
the %windir%\registration directory may experience various problems after
you install the Microsoft Security Bulletin MS05-051 for COM+ and MS DTC
http://support.microsoft.com/kb/909444

You can also check the system eventlog to see whether there is any useful
info there. Though I'm not expert on MSDTC /COM+, I can help you check for
some former or exsting issues. Please feel free to post here if you have
any new finding.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead


Delighting our customers is our #1 priority. We welcome your comments and
suggestions about how we can improve the support we provide to you. Please
feel free to let my manager know what you think of the level of service
provided. You can send feedback directly to my manager at:
(e-mail address removed).

==================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.
==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.



--------------------

 

[Steven Cheng [MSFT]]

Thanks for your reply Paul,

I agree with Florin that the Transaction forum maybe the proper one.
Actually, I've originally decided to contact Florin for some ideas on this
issue as he posted something about this in the former thread you mentioned.
So far I haven't any further ideas from the .NET code or configuration
part. If you got any new result from there, welcome to post here also.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead


Delighting our customers is our #1 priority. We welcome your comments and
suggestions about how we can improve the support we provide to you. Please
feel free to let my manager know what you think of the level of service
provided. You can send feedback directly to my manager at:
(e-mail address removed).

==================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.


--------------------

From: =?Utf-8?B?UGF1bCBQcmV3ZXR0?= <[email protected]>
References: <[email protected]>

Subject: RE: MSDTC Error after applying W2K3 SP2
Date: Mon, 14 Apr 2008 04:51:02 -0700

Thanks, Steven.

I reviewed the article and after setting the permissions (they were already
there under the Advanced settings, but I set them on the main just in case)
and restarting, the problem persists.

There are no event log entries that relate to this error except the one
logged from ASP.NET in the App log, which provides no additional information
(I should have mentioned that in the original post).

On Florin Lazar's recommendation, I have posted the problem over in the
Transactions forums, which he says is monitored by the Transactions team
daily. I hope to make more progress there.

http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=3171653&SiteID=1

Of course, if you have any additional ideas, I'm all ears and appreciate
your help.

 

[Paul Prewett]

I haven't received much help over there yet. I was hoping that Florin would
reply with some ideas.

I'm really hoping not to have to burn one of my MSDN support cases on this
one, but time is drawing near when I'm going to have to get those servers
back into the cluster. I'm currently running at 50% in my production
environment.

Could you follow up with him to see if he has any ideas that he might offer?

Much appreciated, Steven.

 

[Steven Cheng [MSFT]]

Hi Paul,

Sure, I've already sent email to Florin with the issue description and wait
for some further suggestion from him. I'll inform you if I get any update
from him.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead


Delighting our customers is our #1 priority. We welcome your comments and
suggestions about how we can improve the support we provide to you. Please
feel free to let my manager know what you think of the level of service
provided. You can send feedback directly to my manager at:
(e-mail address removed).

==================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------

From: =?Utf-8?B?UGF1bCBQcmV3ZXR0?= <[email protected]>
References: <[email protected]>

<[email protected]>

Subject: RE: MSDTC Error after applying W2K3 SP2
Date: Tue, 15 Apr 2008 03:35:00 -0700

 

[Steven Cheng [MSFT]]

Hi Paul,

I've managed to get contact with Florin and it seems so far from the
symptom you described, it does seems like the same one he encoutered
before. Currently the best approach to troubleshooting may require
collection further information from the problem machine and his suggestion
is forward the issue to product support team via a profesional support
case(since that will require more resource allocated for troubleshooting
the issue from the product support team engineers).

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead


Delighting our customers is our #1 priority. We welcome your comments and
suggestions about how we can improve the support we provide to you. Please
feel free to let my manager know what you think of the level of service
provided. You can send feedback directly to my manager at:
(e-mail address removed).

==================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------

Content-Type: text/plain
Content-Transfer-Encoding: 7bit
From: (e-mail address removed) (Steven Cheng [MSFT])
Organization: Microsoft
Date: Tue, 22 Apr 2008 03:33:55 GMT
Subject: RE: MSDTC Error after applying W2K3 SP2