Event ID 10016 - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

Anonymous
2012-11-20T22:14:35+00:00

Lately I get this system error a lot now that I have upgraded to Windows 8 Pro is a DistributedCom Event ID 10016. Below is the error text:

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{D63B10C5-BB46-4990-A94F-E40B9D520160}

and APPID

{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}

to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Anybody have any idea why I'm getting this error?

Walt

Windows for home | Previous Windows versions | Performance and system failures

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments
Answer accepted by question author
Anonymous
2013-12-22T16:53:28+00:00

Same thing here. Greyed out. Windows 8.1 seems to fill the Event viewer with far more errors than previous versions.

edit: OK, found out why it was greyed out. There are 2 reg keys you have to set permissions to before you go to the DCOM Configuration in Component services. The CLSID key and the APPID key.

From another forum, although it applies to a different app, same principle:

*1. Open Regedit.2. Go to HKEY_Classes_Root\CLSID\*CLSID*.Note: *CLSID* stand for the ID that appears in your event viewer error. In your case, it's {C2F03A33-21F5-47FA-B4BB-156362A2F239}.3. Right click on it then select permission.4. Click Advance and change the owner to administrators. Also click the box that will appear below the owner line.5. Apply full control.6. Close the tab then go to HKEY_LocalMachine\Software\Classes\AppID\*APPID*.Note: *AppID* is the ID that appears in your event viewer. In your case it's {316CDED5-E4AE-4B15-9113-7055D84DCC97}.7. Right click on it then select permission.8. Click Advance and change the owner to administrators.9. Click the box that will appear below the owner line.10. Click Apply and grant full control to Administrators.11. Close all tabs and go to Administrative tool.12. Open component services.13. Click Computer, click my computer, then click DCOM.14. Look for the corresponding service that appears on the error viewer.15. Right click on it then click properties.16. Click security tab then click Add User. Add SYSTEM then apply.17. Tick the Activate local box.So use the relevant keys here and the DCOM Config should give you access to the greyed out areas:*CLSID:

{D63B10C5-BB46-4990-A94F-E40B9D520160}

and APPID

{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}

Was this answer helpful?

500+ people found this answer helpful.
0 comments No comments

214 additional answers

Sort by: Newest
  1. Anonymous
    2019-03-30T06:45:34+00:00

    You could try runingthis is n PS. It does the same thing as manual. Might have to tailor it to suit your needs and use the whatif.

    TODO: make these parameters?

    $CLSID = "{D63B10C5-BB46-4990-A94F-E40B9D520160}"

    $APPID = "{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}"

    To take ownership of a registry key:

    https://social.technet.microsoft.com/Forums/windowsserver/en-US/e718a560-2908-4b91-ad42-d392e7f8f1ad/take-ownership-of-a-registry-key-and-change-permissions?forum=winserverpowershell

    Originally from here maybe?

    http://www.leeholmes.com/blog/2010/09/24/adjusting-token-privileges-in-powershell/

    ************************* START enable-privilege

    function enable-privilege {

     param(

      ## The privilege to adjust. This set is taken from

      ## http://msdn.microsoft.com/en-us/library/bb530716(VS.85).aspx

      [ValidateSet(

       "SeAssignPrimaryTokenPrivilege", "SeAuditPrivilege", "SeBackupPrivilege",

       "SeChangeNotifyPrivilege", "SeCreateGlobalPrivilege", "SeCreatePagefilePrivilege",

       "SeCreatePermanentPrivilege", "SeCreateSymbolicLinkPrivilege", "SeCreateTokenPrivilege",

       "SeDebugPrivilege", "SeEnableDelegationPrivilege", "SeImpersonatePrivilege", "SeIncreaseBasePriorityPrivilege",

       "SeIncreaseQuotaPrivilege", "SeIncreaseWorkingSetPrivilege", "SeLoadDriverPrivilege",

       "SeLockMemoryPrivilege", "SeMachineAccountPrivilege", "SeManageVolumePrivilege",

       "SeProfileSingleProcessPrivilege", "SeRelabelPrivilege", "SeRemoteShutdownPrivilege",

       "SeRestorePrivilege", "SeSecurityPrivilege", "SeShutdownPrivilege", "SeSyncAgentPrivilege",

       "SeSystemEnvironmentPrivilege", "SeSystemProfilePrivilege", "SeSystemtimePrivilege",

       "SeTakeOwnershipPrivilege", "SeTcbPrivilege", "SeTimeZonePrivilege", "SeTrustedCredManAccessPrivilege",

       "SeUndockPrivilege", "SeUnsolicitedInputPrivilege")]

      $Privilege,

      ## The process on which to adjust the privilege. Defaults to the current process.

      $ProcessId = $pid,

      ## Switch to disable the privilege, rather than enable it.

      [Switch] $Disable

     )

     ## Taken from P/Invoke.NET with minor adjustments.

     $definition = @'

     using System;

     using System.Runtime.InteropServices;

      

     public class AdjPriv

     {

      [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]

      internal static extern bool AdjustTokenPrivileges(IntPtr htok, bool disall,

       ref TokPriv1Luid newst, int len, IntPtr prev, IntPtr relen);

      

      [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]

      internal static extern bool OpenProcessToken(IntPtr h, int acc, ref IntPtr phtok);

      [DllImport("advapi32.dll", SetLastError = true)]

      internal static extern bool LookupPrivilegeValue(string host, string name, ref long pluid);

      [StructLayout(LayoutKind.Sequential, Pack = 1)]

      internal struct TokPriv1Luid

      {

       public int Count;

       public long Luid;

       public int Attr;

      }

      

      internal const int SE_PRIVILEGE_ENABLED = 0x00000002;

      internal const int SE_PRIVILEGE_DISABLED = 0x00000000;

      internal const int TOKEN_QUERY = 0x00000008;

      internal const int TOKEN_ADJUST_PRIVILEGES = 0x00000020;

      public static bool EnablePrivilege(long processHandle, string privilege, bool disable)

      {

       bool retVal;

       TokPriv1Luid tp;

       IntPtr hproc = new IntPtr(processHandle);

       IntPtr htok = IntPtr.Zero;

       retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok);

       tp.Count = 1;

       tp.Luid = 0;

       if(disable)

       {

        tp.Attr = SE_PRIVILEGE_DISABLED;

       }

       else

       {

        tp.Attr = SE_PRIVILEGE_ENABLED;

       }

       retVal = LookupPrivilegeValue(null, privilege, ref tp.Luid);

       retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero);

       return retVal;

      }

     }

    '@

     $processHandle = (Get-Process -id $ProcessId).Handle

     $type = Add-Type $definition -PassThru

     $type[0]::EnablePrivilege($processHandle, $Privilege, $Disable)

    }

    ************************* END enable-privilege

    try {

        Write-Host "Script start"

        

        # Steps we are automating are listed here:

        # http://answers.microsoft.com/en-us/windows/forum/windows\_8-performance/event-id-10016-the-application-specific-permission/9ff8796f-c352-4da2-9322-5fdf8a11c81e?auth=1

        # Adjust the permissions for these keys

        Write-Host "CLSID is $CLSID"

        Write-Host "APPID is $APPID"

        # to check your priviledges:

        # whoami /priv

        enable-privilege SeTakeOwnershipPrivilege

        enable-privilege SeRestorePrivilege

        # To change the owner you need SeRestorePrivilege

        # http://stackoverflow.com/questions/6622124/why-does-set-acl-on-the-drive-root-try-to-set-ownership-of-the-object

        $key = [Microsoft.Win32.Registry]::ClassesRoot.OpenSubKey("CLSID$CLSID",[Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree,[System.Security.AccessControl.RegistryRights]::takeownership)

        if ($key -eq $null) {

            Write-Host "Unable to get registry key HKCR:\CLSID$CLSID"

            exit 1

        }

        Write-Host "Opened registry key $($key.Name)"

        # You must get a blank acl for the key b/c you do not currently have access

        #$acl = $key.GetAccessControl([System.Security.AccessControl.AccessControlSections]::None)

        #$me = [System.Security.Principal.NTAccount]"t-alien\tome"

        #$admin = [System.Security.Principal.NTAccount]"Administrator"

        #$acl.SetOwner($admin)

        #$key.SetAccessControl($acl)

        $cname = $env:computername

        $admin = [System.Security.Principal.NTAccount]"$cname\Administrator"

        Write-Host "Setting owner to $($admin.Value)"

        $acl = $key.GetAccessControl()

        $acl.SetOwner($admin)

        $key.SetAccessControl($acl)

        $key.Close()

        # After you have set owner you need to get the acl with the perms so you can modify it.

        

        #$rule = New-Object System.Security.AccessControl.RegistryAccessRule("Administrator","FullControl","Allow")

        #$acl.SetAccessRule($rule)

        #$key.SetAccessControl($acl)

    } catch {

        $ErrorMessage = $_.Exception.Message

        $FailedItem = $_.Exception.ItemName

        Write-Host "Error running setDCOMpermissions"

        Write-Host $_.Exception|format-list

        exit 1

    }

    Code originally from:

    https://social.technet.microsoft.com/Forums/systemcenter/en-US/dfc465bc-7bbd-483e-b98b-2ba56fa98313/the-applicationspecific-permission-settings-do-not-grant-local-launch-permission-for-the-com-server?forum=configmgrgeneral

    #$CLSID = "{3f2db10f-6368-4702-a4b1-e5149d931371}"

    New-PSDrive Creates temporary and persistent mapped network drives.

    #New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null

    #$key = Get-Item "HKCR:\CLSID$CLSID"

    #$values = Get-ItemProperty $key.PSPath

    #$values.'(default)'

    #$key = Get-Item "HKCR:\AppID$CLSID"

    #$values = Get-ItemProperty $key.PSPath

    #$values.'(default)'

    #Remove-PSDrive -Name  HKCR

    Write-Host "Script complete"

    "Ahhh, looking at your solution vs the first one, I've gotta say the first one is way shorter and with less chance of making an error.  I wish I had your smarts on writing command script but after looking at it again...maybe not."

    Was this answer helpful?

    0 comments No comments
  2. Anonymous
    2019-03-09T05:26:24+00:00

    Same thing here. Greyed out. Windows 8.1 seems to fill the Event viewer with far more errors than previous versions.

    edit: OK, found out why it was greyed out. There are 2 reg keys you have to set permissions to before you go to the DCOM Configuration in Component services. The CLSID key and the APPID key.

    From another forum, although it applies to a different app, same principle:

    *1. Open Regedit.2. Go to HKEY_Classes_Root\CLSID\*CLSID*.Note: *CLSID* stand for the ID that appears in your event viewer error. In your case, it's {C2F03A33-21F5-47FA-B4BB-156362A2F239}.3. Right click on it then select permission.4. Click Advance and change the owner to administrators. Also click the box that will appear below the owner line.5. Apply full control.6. Close the tab then go to HKEY_LocalMachine\Software\Classes\AppID\*APPID*.Note: *AppID* is the ID that appears in your event viewer. In your case it's {316CDED5-E4AE-4B15-9113-7055D84DCC97}.7. Right click on it then select permission.8. Click Advance and change the owner to administrators.9. Click the box that will appear below the owner line.10. Click Apply and grant full control to Administrators.11. Close all tabs and go to Administrative tool.12. Open component services.13. Click Computer, click my computer, then click DCOM.14. Look for the corresponding service that appears on the error viewer.15. Right click on it then click properties.16. Click security tab then click Add User. Add SYSTEM then apply.17. Tick the Activate local box.So use the relevant keys here and the DCOM Config should give you access to the greyed out areas:*CLSID:

    {D63B10C5-BB46-4990-A94F-E40B9D520160}

    and APPID

    {9CA88EE3-ACB7-47C8-AFC4-AB702511C276}

    hi all

    i already follow the instruction but in step 16 i have notification like this. So i cant add user or edit the permission

    i already change the owner for that application ID in registry editor to administrator(user). Please help

    Thanks before

    Was this answer helpful?

    0 comments No comments
  3. Anonymous
    2019-02-03T21:48:40+00:00

    Not sure if event 10016 is related or not.  

    Check out :  http://www.tomshardware.com/forum/377752-31-computer-restarting-gaming

    Was this answer helpful?

    0 comments No comments
  4. Anonymous
    2019-02-03T06:53:36+00:00

    Hi my computer restarts every time i load certain games up on my PC. Modern gaming build and only happens under certain titles.

    The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 

    Windows.SecurityCenter.WscCloudBackupProvider

     and APPID 

    Unavailable

     to the user DESKTOP-KH758VE\jarre SID (S-1-5-21-1766856309-369776360-2247513701-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

    No idea whats going on.

    Was this answer helpful?

    0 comments No comments