Monday, January 31, 2011

DistributedCOM Event ID: 10016 error logged on Windows Server 2008 R2 64-bit

I was recently made aware that Event ID: 10016 errors were logged on a server every time it was rebooted and was asked to have a look at it to see if I could quickly fix it.  Taking a look at the System logs on the server shows the following:


The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID




to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.


Since I’ve come across similar errors such as these in the past with SharePoint deployments, I began the troubleshooting by trying to figure out exactly which DCOM object this CLSID and APPID belonged to.  To do this, copy either of the identifiers (CLSID or APPID) because they reference the same object, open up the registry editor with (regedit), then do a search for the string:



Once the find completes, you’ll be at the location: Computer\HKEY_CLASSES_ROOT\Wow6432Node\CLSID\<identifier>

Notice how the left window pane has the CLSID and the right window pane has the APPID listed?  As the window shows, this is actually the DCOM object: Quarantine Private SHA Binding class


What’s special about this DCOM object is that you won’t find it listed when you open up Component Services from the Administrative Tools under the DCOM Config folder:


To find the DCOM object that maps to Quarantine Private SHA Binding class, you need to take the APPID unique identifier from the registry and map it to the APPID in Component ServicesDCOM Config folder.  As shown in the screenshot above, the DCOM object is actually named NAP Agent Service under Component Services:


Unfortunately, there isn’t much you can do if you open up the properties of the DCOM object as all the settings are grayed out:


After some research on this, the fix is to change the service’s startup property to Automatic instead of Manual.



So why does this happen?  While there are various reasons that can cause this, it’s usually because you have some other application that relies on this service and hence causes this error to be thrown when that application makes an attempt to launch this object (in our case, an application was trying to launch this object during startup).  For more information about this service, see the following link:


Anonymous said...

Thanks you. This is the exact issue I was having and it's fixed.

Shannon said...

I had this same exact problem as well, and your instructions were "spot on." Thanks for taking the time to post this.


Many Thanks Terence! This worked for me.

Sussex County GOTR said...

Thank you!

jmmartin said...


Mostafa said...

Really, Thanks god for reaching this post, Thank you very much for great effort.

Anonymous said...

if you have Kaspersky, the problem may come from there

Eric said...

thanks alot for the fix. It saved me countless hours when i already need a 30 day.

Your the man!!

LZRO said...

Maximum Kudos to terrence,

Anonymous said...

thank you sooooooooo much Terence,you saved us:):):)
keep on

Anonymous said...

"Unfortunately, there isn’t much you can do if you open up the properties of the DCOM object as all the settings are grayed out."

You can edit the registry so that the properties are no longer grayed out. Open up REGEDIT and browse to "HKEY_CLASSES_ROOT\AppID\{B292921D-AF50-400C-9B75-0C57A7F29BA1}" key. Right-click on the {B292921D-AF50-400C-9B75-0C57A7F29BA1} key and select Permissions. Click the Advanced button in Permissions window and select the local Administrators group and click on Apply, then OK. Then under Permissions tab, select the local Administrators group and choose 'Full Control' as the permission setting, click Apply, then OK. Rerun component services and you should be able to get into the properties screen with full access now.

Priya Kannan said...

That was a great message in my carrier, and It's wonderful commands like mind relaxes with understand words of knowledge by information's.
SQL Server Training in Chennai

Lathika Honey said...

This Blog Provides Very Useful and Important Information. I just Want to share this blog with my friends and family members. Tibco Certification Training

Unknown said...

I am really happy with your blog because your article is very unique and powerful for new reader.
Click here:
Selenium Training in Chennai | Selenium Training in Bangalore | Selenium Training in Pune

Anonymous said...

Great content thanks for sharing this informative blog which provided me technical information keep posting.

angularjs Training in chennai
angularjs Training in chennai

angularjs-Training in tambaram

angularjs-Training in sholinganallur

angularjs-Training in velachery

Ananya Krishnan said...

Good job in presenting the correct content with the clear explanation. The content looks real with valid information. Good Work

DevOps is currently a popular model currently organizations all over the world moving towards to it. Your post gave a clear idea about knowing the DevOps model and its importance.

Good to learn about DevOps at this time.

devops training in chennai | devops training in chennai with placement | devops training in chennai omr | devops training in velachery | devops training in chennai tambaram | devops institutes in chennai | devops certification in chennai

Revathy said...

I really like your blog. You make it interesting to read and entertaining at the same time. I cant wait to read more from you.
angularjs Training in bangalore

angularjs Training in btm

angularjs Training in electronic-city

angularjs online Training

angularjs Training in marathahalli