DCOM error 10016 with SharePoint 2010 on Windows Server 2008 R2

This used to happen with MOSS 2007 on Server 2003 too, so I wasn’t that concerned… Usual process of finding the CLSID in the Registry and changing the permissions using the Component services snap-in… Or so I thought…

 

Here is the error:

 

Log Name:      System
Source:        Microsoft-Windows-DistributedCOM
Date:          29/10/2009 11:52:52
Event ID:      10016
Task Category: None
Level:         Error
Keywords:      Classic
User:          CORPNET\_SP_Farm
Computer:      SP2010TP.CORPNET.beta
Description:
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{61738644-F196-11D0-9953-00C04FD919C1}
and APPID
{61738644-F196-11D0-9953-00C04FD919C1}
to the user CORPNET\_SP_Farm SID (S-1-5-21-1469829728-1532128048-1498870291-1109) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
    <EventID Qualifiers="49152">10016</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2009-10-29T11:52:52.000000000Z" />
    <EventRecordID>2246</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>SP2010TP.CORPNET.beta</Computer>
    <Security UserID="S-1-5-21-1469829728-1532128048-1498870291-1101" />
  </System>
  <EventData>
    <Data Name="param1">application-specific</Data>
    <Data Name="param2">Local</Data>
    <Data Name="param3">Activation</Data>
    <Data Name="param4">{61738644-F196-11D0-9953-00C04FD919C1}</Data>
    <Data Name="param5">{61738644-F196-11D0-9953-00C04FD919C1}</Data>
    <Data Name="param6">CORPNET</Data>
    <Data Name="param7">_SP_Farm</Data>
    <Data Name="param8">S-1-5-21-1469829728-1532128048-1498870291-1109</Data>
    <Data Name="param9">LocalHost (Using LRPC)</Data>
  </EventData>
</Event>

 

I found {61738644-F196-11D0-9953-00C04FD919C1} to be IISWAMREG as I suspected (no harm in verifying the ID in regedit!).

 

Next, I opened the Component Services Snap-In (Start >  Run > comexp.msc) and drilled down through Component Services > Computers > My Computer > DCOM Config > IIS WAMREG Admin Service ….

 

Only to find all options greyed out!!

 

 

At first I thought UAC was the culprit so I ran did the “right click >run as administrator” which made no difference…

 

Thinking it had to be a permissions issue I fired up my old friend Process Monitor (from Sysinternals: http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx) and found I didn’t have permission!

 

Date & Time:    29/10/2009 12:25:35
Event Class:    Registry
Operation:    RegOpenKey
Result:    ACCESS DENIED
Path:    HKCR\AppID\{61738644-F196-11D0-9953-00C04FD919C1}
TID:    748
Duration:    0.0000322
Desired Access:    Write, Query Value, Enumerate Sub Keys, Write DAC

 

So back to Regedit to inspect permissions…

 

Found that as an Administrator I didn’t have full control:

 

 

Granted CORPNET\Administrators full control, re-opened the MMC and was able to correct the permissions, to do this:

 

Open the Component Services Snap-In (Start >  Run > comexp.msc) and drill down through Component Services > Computers > My Computer > DCOM Config > IIS WAMREG Admin Service

 

Right click on IIS WAMREG Admin Service and on the Security tab click Edit in the Launch and Activation  Permissions section.

Grant the account referenced in the event log (mine is _SP_Farm) the following permissions:

 

Allow: Local Launch

Allow: Local Activation

 

 

All done ;)

 

You might as well grant the same rights to the accounts you’re going to use for running Service Apps at this point (or you’ll be back here in a few minutes anyway!).

 

EDIT:

 

As Tristan (http://tristanwatkins.com/) points out, if you do this for the WSS_WPG and WSS_ADMIN_WPG groups (local to each SP2010 server) rather than individual user accounts you will accommodate future changes. Thanks Tristan!