Event ID 10016 - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

Anonymous
2012-11-20T22:14:35+00:00

Lately I get this system error a lot now that I have upgraded to Windows 8 Pro is a DistributedCom Event ID 10016. Below is the error text:

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{D63B10C5-BB46-4990-A94F-E40B9D520160}

and APPID

{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}

to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Anybody have any idea why I'm getting this error?

Walt

Windows for home | Previous Windows versions | Performance and system failures

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments
Answer accepted by question author
Anonymous
2013-12-22T16:53:28+00:00

Same thing here. Greyed out. Windows 8.1 seems to fill the Event viewer with far more errors than previous versions.

edit: OK, found out why it was greyed out. There are 2 reg keys you have to set permissions to before you go to the DCOM Configuration in Component services. The CLSID key and the APPID key.

From another forum, although it applies to a different app, same principle:

*1. Open Regedit.2. Go to HKEY_Classes_Root\CLSID\*CLSID*.Note: *CLSID* stand for the ID that appears in your event viewer error. In your case, it's {C2F03A33-21F5-47FA-B4BB-156362A2F239}.3. Right click on it then select permission.4. Click Advance and change the owner to administrators. Also click the box that will appear below the owner line.5. Apply full control.6. Close the tab then go to HKEY_LocalMachine\Software\Classes\AppID\*APPID*.Note: *AppID* is the ID that appears in your event viewer. In your case it's {316CDED5-E4AE-4B15-9113-7055D84DCC97}.7. Right click on it then select permission.8. Click Advance and change the owner to administrators.9. Click the box that will appear below the owner line.10. Click Apply and grant full control to Administrators.11. Close all tabs and go to Administrative tool.12. Open component services.13. Click Computer, click my computer, then click DCOM.14. Look for the corresponding service that appears on the error viewer.15. Right click on it then click properties.16. Click security tab then click Add User. Add SYSTEM then apply.17. Tick the Activate local box.So use the relevant keys here and the DCOM Config should give you access to the greyed out areas:*CLSID:

{D63B10C5-BB46-4990-A94F-E40B9D520160}

and APPID

{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}

Was this answer helpful?

500+ people found this answer helpful.
0 comments No comments

214 additional answers

Sort by: Most helpful
  1. Anonymous
    2018-09-11T19:43:49+00:00

    You could try runingthis is n PS. It does the same thing as manual. Might have to tailor it to suit your needs and use the whatif.

    TODO: make these parameters?

    $CLSID = "{D63B10C5-BB46-4990-A94F-E40B9D520160}"

    $APPID = "{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}"

    To take ownership of a registry key:

    https://social.technet.microsoft.com/Forums/windowsserver/en-US/e718a560-2908-4b91-ad42-d392e7f8f1ad/take-ownership-of-a-registry-key-and-change-permissions?forum=winserverpowershell

    Originally from here maybe?

    http://www.leeholmes.com/blog/2010/09/24/adjusting-token-privileges-in-powershell/

    ************************* START enable-privilege

    function enable-privilege {

     param(

      ## The privilege to adjust. This set is taken from

      ## http://msdn.microsoft.com/en-us/library/bb530716(VS.85).aspx

      [ValidateSet(

       "SeAssignPrimaryTokenPrivilege", "SeAuditPrivilege", "SeBackupPrivilege",

       "SeChangeNotifyPrivilege", "SeCreateGlobalPrivilege", "SeCreatePagefilePrivilege",

       "SeCreatePermanentPrivilege", "SeCreateSymbolicLinkPrivilege", "SeCreateTokenPrivilege",

       "SeDebugPrivilege", "SeEnableDelegationPrivilege", "SeImpersonatePrivilege", "SeIncreaseBasePriorityPrivilege",

       "SeIncreaseQuotaPrivilege", "SeIncreaseWorkingSetPrivilege", "SeLoadDriverPrivilege",

       "SeLockMemoryPrivilege", "SeMachineAccountPrivilege", "SeManageVolumePrivilege",

       "SeProfileSingleProcessPrivilege", "SeRelabelPrivilege", "SeRemoteShutdownPrivilege",

       "SeRestorePrivilege", "SeSecurityPrivilege", "SeShutdownPrivilege", "SeSyncAgentPrivilege",

       "SeSystemEnvironmentPrivilege", "SeSystemProfilePrivilege", "SeSystemtimePrivilege",

       "SeTakeOwnershipPrivilege", "SeTcbPrivilege", "SeTimeZonePrivilege", "SeTrustedCredManAccessPrivilege",

       "SeUndockPrivilege", "SeUnsolicitedInputPrivilege")]

      $Privilege,

      ## The process on which to adjust the privilege. Defaults to the current process.

      $ProcessId = $pid,

      ## Switch to disable the privilege, rather than enable it.

      [Switch] $Disable

     )

     ## Taken from P/Invoke.NET with minor adjustments.

     $definition = @'

     using System;

     using System.Runtime.InteropServices;

     public class AdjPriv

     {

      [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]

      internal static extern bool AdjustTokenPrivileges(IntPtr htok, bool disall,

       ref TokPriv1Luid newst, int len, IntPtr prev, IntPtr relen);

      [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]

      internal static extern bool OpenProcessToken(IntPtr h, int acc, ref IntPtr phtok);

      [DllImport("advapi32.dll", SetLastError = true)]

      internal static extern bool LookupPrivilegeValue(string host, string name, ref long pluid);

      [StructLayout(LayoutKind.Sequential, Pack = 1)]

      internal struct TokPriv1Luid

      {

       public int Count;

       public long Luid;

       public int Attr;

      }

      internal const int SE_PRIVILEGE_ENABLED = 0x00000002;

      internal const int SE_PRIVILEGE_DISABLED = 0x00000000;

      internal const int TOKEN_QUERY = 0x00000008;

      internal const int TOKEN_ADJUST_PRIVILEGES = 0x00000020;

      public static bool EnablePrivilege(long processHandle, string privilege, bool disable)

      {

       bool retVal;

       TokPriv1Luid tp;

       IntPtr hproc = new IntPtr(processHandle);

       IntPtr htok = IntPtr.Zero;

       retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok);

       tp.Count = 1;

       tp.Luid = 0;

       if(disable)

       {

        tp.Attr = SE_PRIVILEGE_DISABLED;

       }

       else

       {

        tp.Attr = SE_PRIVILEGE_ENABLED;

       }

       retVal = LookupPrivilegeValue(null, privilege, ref tp.Luid);

       retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero);

       return retVal;

      }

     }

    '@

     $processHandle = (Get-Process -id $ProcessId).Handle

     $type = Add-Type $definition -PassThru

     $type[0]::EnablePrivilege($processHandle, $Privilege, $Disable)

    }

    ************************* END enable-privilege

    try {

        Write-Host "Script start"

        # Steps we are automating are listed here:

        # http://answers.microsoft.com/en-us/windows/forum/windows\_8-performance/event-id-10016-the-application-specific-permission/9ff8796f-c352-4da2-9322-5fdf8a11c81e?auth=1

        # Adjust the permissions for these keys

        Write-Host "CLSID is $CLSID"

        Write-Host "APPID is $APPID"

        # to check your priviledges:

        # whoami /priv

        enable-privilege SeTakeOwnershipPrivilege

        enable-privilege SeRestorePrivilege

        # To change the owner you need SeRestorePrivilege

        # http://stackoverflow.com/questions/6622124/why-does-set-acl-on-the-drive-root-try-to-set-ownership-of-the-object

        $key = [Microsoft.Win32.Registry]::ClassesRoot.OpenSubKey("CLSID$CLSID",[Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree,[System.Security.AccessControl.RegistryRights]::takeownership)

        if ($key -eq $null) {

            Write-Host "Unable to get registry key HKCR:\CLSID$CLSID"

            exit 1

        }

        Write-Host "Opened registry key $($key.Name)"

        # You must get a blank acl for the key b/c you do not currently have access

        #$acl = $key.GetAccessControl([System.Security.AccessControl.AccessControlSections]::None)

        #$me = [System.Security.Principal.NTAccount]"t-alien\tome"

        #$admin = [System.Security.Principal.NTAccount]"Administrator"

        #$acl.SetOwner($admin)

        #$key.SetAccessControl($acl)

        $cname = $env:computername

        $admin = [System.Security.Principal.NTAccount]"$cname\Administrator"

        Write-Host "Setting owner to $($admin.Value)"

        $acl = $key.GetAccessControl()

        $acl.SetOwner($admin)

        $key.SetAccessControl($acl)

        $key.Close()

        # After you have set owner you need to get the acl with the perms so you can modify it.

        #$rule = New-Object System.Security.AccessControl.RegistryAccessRule("Administrator","FullControl","Allow")

        #$acl.SetAccessRule($rule)

        #$key.SetAccessControl($acl)

    } catch {

        $ErrorMessage = $_.Exception.Message

        $FailedItem = $_.Exception.ItemName

        Write-Host "Error running setDCOMpermissions"

        Write-Host $_.Exception|format-list

        exit 1

    }

    Code originally from:

    https://social.technet.microsoft.com/Forums/systemcenter/en-US/dfc465bc-7bbd-483e-b98b-2ba56fa98313/the-applicationspecific-permission-settings-do-not-grant-local-launch-permission-for-the-com-server?forum=configmgrgeneral

    #$CLSID = "{3f2db10f-6368-4702-a4b1-e5149d931371}"

    New-PSDrive Creates temporary and persistent mapped network drives.

    #New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null

    #$key = Get-Item "HKCR:\CLSID$CLSID"

    #$values = Get-ItemProperty $key.PSPath

    #$values.'(default)'

    #$key = Get-Item "HKCR:\AppID$CLSID"

    #$values = Get-ItemProperty $key.PSPath

    #$values.'(default)'

    #Remove-PSDrive -Name  HKCR

    Write-Host "Script complete"

    Was this answer helpful?

    0 comments No comments
  2. Anonymous
    2018-09-11T17:24:01+00:00

    When this problem first occurred and I wrote that blog (years ago); the error did cause some issues.   Now a days the error has several more causes and none that I can tell cause issues.  I will not say it can safely be ignored nor will I say it causes issues.  The only reason I still have the blog up is for the steps on how to take ownership of a locked down DCOM object.  Interesting for what it does.  No harm in changing the ownership to a known account.  Could you do something silly to break security with this knowledge?  Absolutely.  Any more harm than plugging in an unknown USB key laying the parking lot?  no.  

    Have fun

    Was this answer helpful?

    0 comments No comments
  3. Anonymous
    2018-09-11T17:11:56+00:00

    I have fixed this DCOM errors many times according with suggestion on this tread. I thought it was my old PC issue but it is Windows10 issue; I have the same on my brand new Laptop. Tired to try again and again; at every update the errors come back.

    Was this answer helpful?

    0 comments No comments
  4. Anonymous
    2018-09-11T16:52:49+00:00

    hah hah "Windows is just getting more and more like Linux, i.e. every day you will see "errors" which are completely normal and meant to be ignored"

    The very definition of an error means it should not be ignored. This thread is so old I have forgotten what it fixed. I can report that I have since moved onto Win10. Issues have changed. Back then the fix worked and did not break anything.

    Was this answer helpful?

    0 comments No comments