Jump to content


Photo

Event ID 10028 on hosting server

High CPU Usage Event ID 10028

  • Please log in to reply
1 reply to this topic

#1 bobinphx

bobinphx

    Newbie

  • Members
  • Pip
  • 1 posts

Posted 17 June 2015 - 03:46 PM

We are getting this error in the System Event log of our ALE hosting server.  These errors occur several times a second.  We run the service under my user account ( a domain admin ) and this error is referring to my Windows 8 workstation.

 

My account is not locked, nor has it been in a very long time, so I do not understand why ALE is trying to contact my workstation.

 

The errors themselves are not that big of a concern, however we discovered this when troubleshooting excessive CPU usage on the server.  We are able to temporarily resolve the high CPU usage by restarting the ALE Service. 

 

DCOM was unable to communicate with the computer wsw8-rdspawn.mydomain.com using any of the configured protocols; requested by PID     177c (C:\Program Files (x86)\NetWrix\Account Lockout Examiner\ALEService.exe).

 

Any assistance in resolving this issue would be greatly appreciated.

 

Thanks



#2 dsmirnov

dsmirnov

    Advanced Member

  • Root Admin
  • PipPipPip
  • 58 posts
  • Gender:Male

Posted 17 June 2015 - 06:11 PM

bobinphx,

 

Account Lockout Examiner looks for lockout events and failed Kerberos authentication on DCs, and once found tries to connect to the caller workstation to find the process there.

 

So it is actually expected to try connecting to workstations. But for some reasons DCOM connection doesn`t work.

 

You can disable this behavior by creating a DWORD called PF_enabled with value of 0 in the HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Netwrix\Account Lockout Examiner key.

 

As for high CPU usage by ALE, please check the KB:

https://www.netwrix.com/kb/1277






0 user(s) are reading this topic

0 members, guests, anonymous users