Event 10016 may be logged in the System log on a computer that is running Windows XP Professional x64 Edition (899965)


The information in this article applies to:

  • Microsoft Windows XP Professional x64 Edition
Important This article contains information about how to modify the registry. Make sure to back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows registry

SYMPTOMS

On a computer that is running Microsoft Windows XP Professional x64 Edition, events that are similar to the following may be logged in the System log: Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10016
Date: Date
Time: Time
User: NT AUTHORITY\LOCAL SERVICE

Description: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {AppGUID} to the user User_Name SID User_SID. This security permission can be modified using the Component Services administrative tool. Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10016
Date: Date
Time: Time
User: Network services

Description: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {AppGUID} to the user User_Name SID User_SID. This security permission can be modified using the Component Services administrative tool.

CAUSE

This problem may occur if either of the following conditions is true:
  • A program with the class ID (CLSID) that appears in the message tries to start the COM component by using the DCOM infrastructure. However, the user does not have the required permissions to start the COM component.
  • The Network Service account does not have the correct permissions.

RESOLUTION

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

To resolve this problem, use one of the following methods, depending on the cause of the problem.

Grant the user permissions to start the COM component

Grant the user permissions to start the COM component. To do this, follow these steps:
  1. Click Start, click Run, type regedit in the Open box, and then click OK.
  2. Locate and then click the following registry subkey:

    HKEY_CLASSES_ROOT\CLSID\CLSID value

    Note In this subkey, "CLSID value" is a placeholder for the CLSID information that appears in the message.
  3. In the right pane, double-click AppID.

    The Edit String dialog box appears. Leave this dialog box open and continue to the next step.
  4. Click Start, click Run, type dcomcnfg in the Open box, and then click OK.

    If a Windows Security Alert message prompts you to keep blocking the Microsoft Management Console program, click to unblock the program.
  5. In Component Services, double-click Component Services, double-click Computers, double-click My Computer, and then click DCOM Config.
  6. In the details pane, locate the program by using the friendly name.

    If the AppGUID identifier is listed instead of the friendly name, locate the program by using this identifier.
  7. Right-click the program, and then click Properties.
  8. Click the Security tab.
  9. In the Launch and Activation Permissions area, click Customize, and then click Edit.
  10. Click Add, type the user's account name, and then click OK.
  11. While the user is selected, click to select the Allow check boxes for the following items:
    • Local Launch
    • Remote Launch
    • Local Activation
    • Remote Activation
  12. Click OK two times.
  13. Quit Registry Editor.

Grant the correct permissions to the Network Service account

To grant the correct permissions to the Network Service account, follow these steps:
  1. Click Start, click Run, type dcomcnfg in the Open box, and then click OK.
  2. In Component Services, double-click Component Services, and then double-click Computers.
  3. Right-click My Computer, and then click Properties.
  4. Click the COM Security tab.
  5. In the Launch and Activation Permissions area, click Edit Default.
  6. Click Add, type Network Service, and then click OK.
  7. While Network Service is selected, click to select the Allow check boxes for the following items:
    • Local Launch
    • Remote Launch
    • Local Activation
    • Remote Activation
    Click OK two times.

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

MORE INFORMATION

For more information about the x64-based versions of Windows Server 2003 and about Windows XP Professional x64 Edition, click the following article number to view the article in the Microsoft Knowledge Base:

888733 A description of the x64-based versions of Windows Server 2003 and of Windows XP Professional x64 Edition

For more information about computer-wide restrictions, visit the following Microsoft Web site:

http://msdn.microsoft.com/security/productinfo/XPSP2/networkprotection/computer_wide_restr.aspx

For more information about granular COM permissions, visit the following Microsoft Web site:

http://msdn.microsoft.com/security/productinfo/XPSP2/networkprotection/granular_com_permissions.aspx

Modification Type:MajorLast Reviewed:5/25/2005
Keywords:kbtshoot KB899965 kbAudITPRO
©2004 Microsoft Corporation. All rights reserved.