DistributedCOM DC Server Event ID 10016 DCDIAG Error [Fixed]

Read this guide to learn how to fix the dcdiag error message, “The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID” Event ID 10016 error.

Step 0: Review the Problem Background and Overview

I recently promoted a Windows Server 2019 Server as an additional DC in a domain. After promoting the server, I completed the following tasks:

1. Confirmed that the server was added to its AD site
2. Ran “repadmin /kcc” and verified that a replication connection was automatically generated.
3. Verified that the server’s subnet is associated with its local AD site.

Finally, to ensure that there were no replication errors, I ran dcdiag (link opens in a new browser tab) and piped the result to a text file. When I reviewed the file, I found that the server failed the SystemLog test.

Further review of the dcsdiag file indicates that an event log was logged with the following details: “The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID.”

The source of this event in the System event log is DistributedCOM, with an Event ID of 10016. The error details are in the screenshot below.

I have explained the steps I took to fix the error message in the remaining sections of this article.

Step 1: Change the Ownership of the CLSID Registry Keys

1. Get the offending application’s CLSID from the event error log. This is the sting of values next to the CLSID in the event error log. I have highlighted the application’s CLSID ID in the screenshot below:

2. Search for and open Regedit. Then, navigate to HKEY_Classes_Root\CLSID\<the CLSID string from 1 above>.

3. Right-click the registry key and choose permissions.

4. After that, click the Advanced button in the registry key’s permission properties page, then click the Change button next to the Owner.

5. Then, enter Administrators in the Enter the object names to select box and click Check Names > OK.

6. Finally, check the Replace owners on sub containers and objects checkbox and click OK.

7. Finally, grant the Administrators group Full Control and click OK to close the registry key’s permissions properties window. Do not close the registry editor yet, as you will need to in Step 3 below.

Step 3: Change the Ownership of the APPID Registry Keys

1. Get the offending application’s APPID from the event error log. See mine in the screenshot below.

2. Back in the registry editor, navigate to KEY_LocalMachine\Software\Classes\AppID\ registry key, enter the name of the APPID from your event log at the end of the above path, and press enter.

3. Right-click the APPID’s registry key and choose Permissions. Then, repeat steps 4, 5, 6, and 7 of the last section to make the Domain Administrators group the registry key owner—remember to grant the Administrators group Full Control.

8. Close the registry editor.

Step 4: Grant the User Account Permission to the Service’s DCOM Config

1. Search for and open administrative Tools. Then, locate and open the component services – you can search for it.

2. Then, expand Component services > Computer > My Computer and click DCOM Config.

2. After that, expand DCOM Config, look for the corresponding service in the error viewer, right-click on it, and then choose Properties.

3. On the Properties window, select the Security tab, then in the Access Permission section, select Customize, then click the Edit button.

4. After that, click the Add button.

5. Then, click the Locations button next to From this location, select the name of the local server and click OK.

6. After that, in the Enter the object name to select field, enter the name of the account displayed in the event log error (NT SERVICE\OCAUM) see the first screenshot below) – then, click Check Names, and OK.

7. Finally, grant the account Local and Remote access, then click OK and OK.

Step 5: Rerun DCDIAG to Confirm that the SystemLog Test Passed

1. Clear the System event log by right-clicking it and choosing Clear log. Save a copy of the log in the process if you require it for further troubleshooting.

2. After that, rerun dcdiag to confirm that the SystemLog test passed.

Conclusion

Fixing the “The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID” Event ID 10016 error is as simple as granting the account in the event log error permission to the COM Server application.

In this “fix it” guide, I walked you through the steps to complete this task using a real-life error I encountered after promoting a Windows Server 2019 server to a DC.

I hope this article met your expectations. Let me know by responding to our “Was this page helpful?” request below.