I've got a weird issue with a small business network; mostly XP clients, with some 7, and an SBS 2008 server. It runs on a 24 port Dell switch.
Ping times from workstation to workstation, as well as workstation to server, occasionally spike to abnormally high numbers, enough so that the users notice it. We've been trying to get this nailed down from some time, and I've taken over the issue in the name of having a fresh pair of eyes look at it.
Things which have been done so far:
- The switch has been replaced.
- The NIC in the server has been swapped.
- The server and a workstation have been isolated on a separate switch to test if the latency still occurs [it does].
- I've tested DPC latency (it spikes into the red.)
- The event log also shows errors on a hard drive controller, but the hard disk ID is for an external (used only for nightly backups - I doubt this is the cause).
When I took over the issue, one of the things I checked into was the event log, and I see hundreds of thousands of DCOM errors; 10009, 10016, and 10002. They dominate the majority of the System log, when you filter out Information events. They don't occur all of the time, but when they do, it's every second for a significant period of time. I'm willing to bet that the mass stream of DCOM errors play into this issue.
There is another constraint at play here, as well, which is that one of the PCs which generates a lot of this DCOM noise is a custom job from a vendor for $very_expensive_equipment, which, beyond joining to the domain, we're not allowed to modify in any way or else we void the support contract.
I'd like to solve this DCOM spam issue before I move on and try to find other possible causes. Beyond lowering the firewalls of the workstations, is there a way to simply stop SBS from attempting to poll the machines to get whatever it's trying to get from DCOM? I really don't care if it's able to poll things like machine health, as long as network shares, DNS/DHCP/Exchange/AD functionality isn't compromised.
Alternatively, are there simpler permissions based fixes I can attempt?
Thanks very much.