Event ID 10016 - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

Why is this issue so frequent? 3 out of 3 of our laptops running the Anniversary Update had these errors. While I'm techy enough to fix this on our computers, Microsoft needs to release a true fix to correct their bug.

Yes, that's a very good point. The instructions are very clear that you should click "cancel" at this point but they then seem to imply that you can edit the permissions by adding accounts - but that's certainly not the case for me and as you point out the pop-up does say it will be "read-only". It does seem to leave no way forward.

For the record, I'm getting the 10016 code in my event log when trying to use the Firebird ODBC driver. My application shows "Provider error 8000ffff catastrophic failure". Clicking "Test" in the ODBC Data Sources desktop app causes the app to fall over immediately. In both cases the event log shows the 10016 code. I've had to find a workaround on another computer to get the job done. I would love to get to the bottom of this though, as I have encountered the error code at other times.

Correct!  Well I got tired of the recursive failures, and clicked "Remove", which seems to be the default choice anyway.  Just to be safe, I took a screenshot of both the Launch & Activation and the Access customization permission edit boxes, AND the visible entries remained, and I then added any missing entries generating the "access denied" message and the ones mentioned in Jseipmann's post.  The "Cancel" click seems wrong, and "Remove" was the only way forward. 

No ill effects so far, and I'm not sure there should have been invisible or unable to be displayed entries anyway.  The application specific issue, if a problem, will generate its own Event Log entry ;-) .

Also, I did not propagate the registry permission changes to "child objects", only the ownership change to all subcontainers and objects.

Crossing my fingers.

Note that if, as you say, you click "cancel" to the message

...the permissions window will open read-only, and thus the entries cannot be changed as recommended.

I'm not sure clicking "Remove" is the correct course of action here, either.

Correct!  Well I got tired of the recursive failures, and clicked "Remove", which seems to be the default choice anyway.  Just to be safe, I took a screenshot of both the Launch & Activation and the Access customization permission edit boxes, AND the visible entries remained, and I then added what was missing.  No ill effects so far, and I'm not sure there should have been invisible or unable to be displayed entries anyway.  The application specific issue, if a problem, will generate its own Event Log entry ;-) .

Also, I did not propagate the registry permission changes to "child objects", only the ownership change to all subcontainers and objects.

Crossing my fingers.

Same thing here. Greyed out. Windows 8.1 seems to fill the Event viewer with far more errors than previous versions.

edit: OK, found out why it was greyed out. There are 2 reg keys you have to set permissions to before you go to the DCOM Configuration in Component services. The CLSID key and the APPID key.

From another forum, although it applies to a different app, same principle:

*1. Open Regedit.2. Go to HKEY_Classes_Root\CLSID\*CLSID*.Note: *CLSID* stand for the ID that appears in your event viewer error. In your case, it's {C2F03A33-21F5-47FA-B4BB-156362A2F239}.3. Right click on it then select permission.4. Click Advance and change the owner to administrator. Also click the box that will appear below the owner line.5. Apply full control.6. Close the tab then go to HKEY_LocalMachine\Software\Classes\AppID\*APPID*.Note: *AppID* is the ID that appears in your event viewer. In your case it's {316CDED5-E4AE-4B15-9113-7055D84DCC97}.7. Right click on it then select permission.8. Click Advance and change the owner to administrators.9. Click the box that will appear below the owner line.10. Click Apply and grant full control to Administrators.11. Close all tabs and go to Administrative tool.12. Open component services.13. Click Computer, click my computer, then click DCOM.14. Look for the corresponding service that appears on the error viewer.15. Right click on it then click properties.16. Click security tab then click Add User. Add SYSTEM then apply.17. Tick the Activate local box.So use the relevant keys here and the DCOM Config should give you access to the greyed out areas:*CLSID:

{D63B10C5-BB46-4990-A94F-E40B9D520160}

and APPID

{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}

Nice work.  I went through this with Windows 7 Ultimate, but not nearly as often.  In the interim, I lost the "skill".  I was surprised when I accessed the Application log to check something else and saw all of these Event ID 10016 entries!

BUT , there is one large "fly in the ointment" - actually quite a number of them!!!  I and others have noticed, just as Waltbros did, that there are many Event Id 10016 log entries with the description " ... running in the application container Unavailable SID (Unavailable)..."  what this means is that there is no alphaneumeric "Name" listed in the DCOM Config GUI; the "Name" exactly matches the AppID, and is listed after all of the actual SID names.  There are over 100 of such entries!  I plan to correct the DCOM permissions for these, but the lack of a true SID and alphanumeric name moves this whole thing from tedium to torture!!!

See this related post for Windows 10.

MA

MASTERDENG replied on

A lot of people seem to be getting this error, and there seems to be little to no info out there about it.

The CLSID comes up as CDP Activity Store in regedit, but CDP Activity Store is not an item in DCOM config.

The only thing called CDP is CDP Reference Host, and without knowing how they're related (assuming they are) I wouldn't know what to modify.

Depending on my search wording I also found a lot of technical references to CDP in Windows Server on Technet, and this on VMware:

https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1007069

Does that tell anyone anything?

CDP Activity Store isn't listed as name but the AppID is.

Set it to view in detail and you'll find {F72671A9-012C-4725-9D2F-2A4D32D65169} at the bottom. It listed as the 8th one from the end of the list.

AppID is the same as the CLSID in the regeditor

I don't know if fixes it or not but I'll find out later.

I don't know if it matters but I'll like to put things back the way it was.

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{8D8F4F83-3594-4F07-8369-FC3C3CAE4919} Original Owner is SYSTEM

 and APPID

{F72671A9-012C-4725-9D2F-2A4D32D65169} Original Owner is TrustedInstaller = NT SERVICE\TrustedInstaller

 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Thanks again!