Sysadminsblog.com Anything for sysadmins!

23Aug/100

Event 10016 – DistributedCom

Although I've seen the DCOM error a lot, the one below needed a different approach than usual.

Log Name: System
Source: Microsoft-Windows-DistributedCOM
Date: 23-8-2010 8:40:12
Event ID: 10016
Task Category: None
Level: Error
Keywords: Classic
User: SYSTEM
Computer: server.domain.local
Description:
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {24FF4FDC-1D9F-4195-8C79-0DA39248FF48} and APPID {B292921D-AF50-400C-9B75-0C57A7F29BA1} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
<EventID Qualifiers="49152">10016</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2010-08-23T06:40:12.000000000Z" />
<EventRecordID>4640</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>server.domain.local</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="param1">application-specific</Data>
<Data Name="param2">Local</Data>
<Data Name="param3">Launch</Data>
<Data Name="param4">{24FF4FDC-1D9F-4195-8C79-0DA39248FF48}</Data>
<Data Name="param5">{B292921D-AF50-400C-9B75-0C57A7F29BA1}</Data>
<Data Name="param6">NT AUTHORITY</Data>
<Data Name="param7">SYSTEM</Data>
<Data Name="param8">S-1-5-18</Data>
<Data Name="param9">LocalHost (Using LRPC)</Data>
</EventData>
</Event>

The event was triggered after installing and enabling the Kaspersky Administration Kit service. After some research I found a post on the Technet forums which told me what to do.

Seems like this error is related to the Network Access Protection Agent service. If this service isn't started, this error will occur. To stop the error change the startup type to automatic and start the service.

Tagged as: No Comments