Fixing Event ID: 4209 Part 1

If you’ve ever had this error in the Windows XP eventlog:

Event Type: Error
Event Source: MSDTC
Event Category: (8)
Event ID: 4209
Date: 5/18/2006
Time: 11:09:03 PM
User: N/A
Computer:
Description:
A critical error occurred in an MS DTC component therefore the process is
terminating. The category field identifies the component that encountered
the error. Please contact Microsoft Product Support. Error Specifics:
d:\qxp_slp\com\com1x\dtc\dtc\msdtc\src\cservice.cpp:436, Pid: 3948
No Callstack,
CmdLine: C:\WINDOWS\system32\msdtc.exe

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 46 00 11 80 F..?

You will likely see this next one as well but not necessarily, which is a COM+ error. You need to reinstall COM+.

Event Type: Error
Event Source: COM+
Event Category: (98)
Event ID: 4691
Date: 5/18/2006
Time: 11:07:57 PM
User: N/A
Computer:
Description:
The run-time environment was unable to initialize for transactions required
to support transactional components. Make sure that MS-DTC is running.
(DtcGetTransactionManagerEx(): hr = 0x8004d01b)

You’ll may also get:

• Interface Class Not Registered when viewing service dependencies in the services.msc.
• Errors  in the Event Log pertaining to Volume Shadow Copy.
• A Red Dot under My Computer in Component Services (dcomcnfg.exe).
• Blank screen in Network Connections.
• Windows Firewall control panel gives a message about the network configuration being corrupt when viewing the Advanced tab.
• Various other annoyances and headaches.

You know you’re in some serious trouble. All the error messages are completely vague. Event ID 4209 Reference some source with is useless for us mere mortals. Sure we could dig through the dis-assembly in a debugger, but you better have your cape and superhero mask on for that…

Googling around gives you results for a lot of people with the same problem, and no direct fixes.

DTC Won’t Start…, DTC Won’t Start… and DTC Won’t Start… and Etc.

Suggested fixes in this and prescribed in KB891801 don’t even seem to help. Typically a repair install of windows doesn’t even fix it. The only option seems to be a reformat/reinstall, which is sometimes great, but doesn’t help you the next time you encounter this problem.

The restoring Registry permissions fix above should fix the issue. It didn’t for me in this case. The problem is with the permission of a few keys under HKEY_CLASSES_ROOT.
Specifically:

• HKCR\CID
• HKCR\SVCID
• HKCR\TypedName (Potentially, check it anyway.)
• HKCR\TypeLib (You’re in there anyway, take a look at it.)
• HKCR\CLSID (If this one is broke you probably can’t even boot into windows…)

These keys need to inherit permissions from their parent. Right Click, Click Permissions, Click Advanced. Check Inherit…, Check Reset the permissions of all child entities. Click Ok, be patient for a few. Do the same for them all if necessary.

You want to make sure Administrator and SYSTEM has Full Control and Read, which is the most important. They should get this back by re-inheriting permissions from their parent (CLASSES_ROOT).

Restart, cross your fingers. You should be able to start MSDTC manually. Check the eventlog. Run dcomcnfg, make sure My Computer under Components Services does not have a red dot.

If those things don’t check out you may have other issues with MSDTC. I’ll show you how to figure them out in part 2.

You may still get an Event ID: 4691 and the others. You need to reinstall COM+. It’s not too hard. Sometimes it won’t reinstall fully on it’s own. You may have to remove COM+ and then do a repair install of Windows XP.

Tags: Event ID: 4209, msdtc, screwed, wtf