Recently we experienced a range of MSDTC errors on upgrading to Windows 2003,
running separate web and database servers. The DTC would run fine to
Windows 2000 servers and locally (to itself), but no between Win2003 servers.
The following items summarize the checks made to finally resolve our issues.
www.chriskempster.com
NOTE - It is highly recommend that you reboot both servers between each DTC
change and test thoroughly after.
Essential Utilities
Microsoft support tend to use three core utilities for debugging MSDTC
transactions and associated errors:
1) DTCPing - download from and documented at
http://support.microsoft.com/default.aspx?scid=kb;en-us;306843
2) DTCTester - download from and documented at
http://support.microsoft.com/default.aspx?scid=kb;en-us;293799
3) NetMon - found on Windows setup disks or resource kit
Check 1 - DTC Security Configuration
This is a mandatory check on both W2003 boxes if MSDTC service is intended to
be used.
In administrative tools, navigate down through Component Services ->
Computers, and right-click on My Computer to get properties. There should be an
MSDTC tab, with a "Security Configuration" button. Click on that, and make sure
network transactions are enabled.
Check 2 - Enable network DTC access installed?
Navigate via the Control Panel and Add/Remove Programs, Add/Remove Windows
Components, select Application Server and click details. Ensure the Enable
network DTC access is checked, verify if you also require COM+ access.
Check 3 - Firewall separates DB and Web Server?
MSDTC needs to establish a 2-way connection layered on MSRPC (in which
dynamic ports allocation is used). Please follow 250367 to configure MSDTC over
firewalls: Q250367
http://support.microsoft.com/?id=250367, also refer to article
http://support.microsoft.com/?id=306843
On both DB server and Web server. Reboot is required.
Check 4 - Win 2003 only - Regression to Win 2000
Ensure checks 1 and 2 are complete before reviewing this scenario. Once
done, run through the following items as discussed on this support document:
http://support.microsoft.com/?kbid=555017
If you have success, add in/alter the following registry key, where 1 is ON:
HKLM\Software\Microsoft\MSDTC\FallbackToUnsecureRpcIfNecessary, DWORD, 0/1
Apply of all server involved in the DTC conversation. You need to restart the
MSDTC service.
Check 5 - Win 2003 only - COM+ Default Component Security
New COM+ containers created in COM 1.5 (Windows 2003) will have the
"enforce access checks for this application" enabled.
Uncheck this option is you are experiencing component access errors, or
cannot instantiate object errors on previously running DLL's. Upgraded
operation systems and their containers will not have this option checked.
Also refer to MS support article
http://support.microsoft.com/?id=810153
References
Microsoft Support Services.
