Event ID 10016 The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

On a Windows 10 machine, you may encounter Event ID 10016 in your eventlog:

Source:        Microsoft-Windows-DistributedCOM
Event ID:      10016
Level:         Error
User:          SYSTEM
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (via LRPC) running in the application container not available SID. This security permission can be modified using the Component Services administrative tool.

Well, that reminds me of an old blog post of me, back in 2010. Times have not changed since then: it’s still a hell of a job to fix event id 10016. Especially if your an IT-analphabetic. However, this guide will help you out. Don’t worry. Just make sure you have an Administrator account on your pc and you’re good to go! :-)

Step 1:

Open your event viewer, and make note of the ID’s. In my example, the id’s are:
CLSID : {D63B10C5-BB46-4990-A94F-E40B9D520160}
APPID: {9CA88EE3-ACB7-47C8-AFC4-AB702511C276}

Also make note of the permission required. In my example, these are:
Local Activation permission is required for user NT AUTHORITY\SYSTEM

It’s OK if your ID’s and permissions differ from mine. Just use your own values and don’t switch APPID and CLSID

Step 2:
Open your Registry Editor as an Administrator. To do so, click your start menu, type regedit, right click regedit and click Run as administrator

Step 3
Navigate to HKEY_CLASSES_ROOT\CLSID\{D63B10C5-BB46-4990-A94F-E40B9D520160} (again, if your CLSID is different, choose your own CLSID).

To verify you’re in the right location, take a look at the CLSID, and the values within that key. If right, you also see the APPID as a value.
Write down the Application Name. In my case it’s Runtime Broker. You need this name later on.

Step 4
Right-click the key {D63B10C5-BB46-4990-A94F-E40B9D520160} and click Permissions

Step 5:
In the Permissions window, choose Advanced

Step 6
In the Advance Security Settings window, click Change

Step 7
Type your administrator account. Click Check Names to verify. If you don’t know the name exactly, you can used the Advanced button to search for all accounts and choose the Administrator account by double clicking.
Click OK to confirm

Step 8:
Back in the Advance Security Settings window, click OK to confirm. Notice at the top that the Owner has changed from TrustedInstaller to your administrator account

Step 9:
Back in the “Properties for {…}” window, select the Computername\Administrators and then activate the “Full Permissions” checkbox.
Click OK to confirm.

Step 10:
Well, we’re halfway there! Step 3 to 9 described the configuration for the CLSID {…}. Now, we also need to do the same to the APPID {…}

Navigate to HKEY_CLASSES_ROOT\AppID\{9CA88EE3-ACB7-47c8-AFC4-AB702511C276} (again, if your APPID is different, choose your own APPID).
You can verify you’re in the good location by checking the application name. This is the same application name asin Step 3.

Step 11:
Right-click the key {9CA88EE3-ACB7-47c8-AFC4-AB702511C276} and click Permissions

Step 12
In the Permissions window, choose Advanced

Step 13
In the Advance Security Settings window, click Change

Step 14
Type your administrator account. Click Check Names to verify. If you don’t know the name exactly, you can used the Advanced button to search for all accounts and choose the Administrator account by double clicking.
Click OK to confirm

Step 15
Back in the Advance Security Settings window, click OK to confirm. Notice at the top that the Owner has changed from TrustedInstaller to your administrator account

Step 16
Back in the “Properties for {…}” window, select the Computername\Administrators and then activate the “Full Permissions” checkbox.
Click OK to confirm.

Step 17
Almost there! We now have set all permissions to actually change the Local Activiation settings. The following steps will solve your error.

Click Start, type “Component Services“, rightclick Component Services and click “Run as administrator

Step 18
Navigate to Component Services -> Computers -> My computer -> DCOM Config.
Now, scroll down to the application you have issues with. If you followed my instructions, you wrote the name down at Step 3. In my case, it’s Runtime Broker.
Right click the application name and click Properties

Step 19
Go to tab Security.
Then choose the appropiate action. If you followed my steps, you have written it down at Step 1
In my case, I had issues with Local Activation, so I choose “Launch and Activation Permissions” set to Customize, and then click Edit…
If you had an error related to “do not grant Access permissions”, you would typically choose “Access Permissions” -> Customize, and then click Edit…

Step 20 (last step!!)
In Step 1, you also wrote down the account that caused the error, and the needed action to fix event  id 10016.
In my case, it was “SYSTEM” needing “Local Activation” permissions. This may be the same in your case. But it could also be something like “Network service”  or “Local service”.
Click the name that applies to you, and then click the appropriate permission. As you can see in the screenshot below, I have selected the SYSTEM account and I have set “Local Activation” to Allow

Final thoughts about event id 10016

Well, that took me some time to write down. Did it help you solve your problem? Or do you have additional questions? Please, leave a comment. I’d be happy to reply!

5 15 votes
Article Rating
Notify of
Oldest Most Voted
Inline Feedbacks
View all comments
Jenson M

i can only get to step 9 but after clicking ok im met with the message “unable to save permission changes on {} access is denied” anyway to fix this?

Last edited 5 months ago by Jenson M

Hi there,

I was able to follow this up to step 20 where after I select PerAppRuntimeBroker and select security -> edit I get an error stating

“One or more of the permission entries attached to Registry Value has an unrecognized type and cannot be displayed.”

If I hit okay and move past that all of the check boxes are greyed out.

Furthermore the issue was related to Local Activation – which is already checked.

Any thoughts as to why this may be happening?


Thank you very much for this wonderful article you have written with much devotion and attention. But I am so sorry, it did not resolve my issue :( In my case it was he PerAppRuntimeBroker and it was my domain account that was needing Local Activation permission. I tried to follow all the steps carefully. I have posted the details of my issue at this link here. If anyone has any solution then please let me know.

Thank you. I really respect the amount of work you have done on this website. It is phenomenal!


Good article. I will apply the Access denied solution also that you have suggested.

Last edited 5 months ago by Aamir

Best and most complete coverage I have ever seen of this process. Thanks!


how do you revert settings back to trusted installed for registry owner


You can’t. Ownership needs to be taken. But that is not a problem. As long as you leave the permissions themselves in place for TrustedInstaller, everything keeps working as before


“NT SERVICE\TrustedInstaller”


Danka Bro!


Thank you so much, one note: a reboot may be required after editing all those permissions in Regedit


I did reboot my PC, but did not make any difference :)

Alaa Khalifa

Hi actually i receive this problem logs frequently on my windows servers but despite this problem every thing is working fine so what this problem exactly affect and why i should fix it if every things working fine kindly advice


Superb, thanks!!!!


So sad, everything worked just as you described, but there is NO DCOM Object on my system having the Application Name “APOWrapperSrv Class”.

So, step 18 failed. Still no sound.



Got the same problem. In my case the Application Name in Step 3 was “APOWrapperSrv Class” and in Step 10 it was “Microsoft Audio Device Graph Server”.
Couldn’t find “APOWrapperSrv Class” in DCOM Config so I searched for “Microsoft Audio Device Graph Server” and set the permission as in the Step19/20.

And it works!

Perfect. Thanks a lot for this manual.


Even Microsoft couldn’t fix it…
They just had me install uninstall reinstall reboot 100 times… in place install… finally they gave up and told me I needed a new windows install to fix my audio. So… THANK YOU… Struggled with this for 2 weeks


Thanks a lot for sharing this document, I hope these steps will solve my issue which was similar to the one you had.


Many thanks, this solved my audio issues on Windows 10 after IT helpdesk was helpless.
I could not find the obscure name of the service from CLSID in the DCOM config so I choose the name listed in the APPID regedit entry which was linked to audio.


Unfortunately, “ShellExplorerHost” is not listed in Component Services… so I can’t fix it. Ideas?


Try looking at the ID instead of the name and/or look at the service name in APPID.


Can anyone explain what the impact of these errors are? And when and you would want to correct them? MSFT’s own support cites a few examples of these errors but says they’re by design and to ignore them. (??) https://support.microsoft.com/en-us/help/4022522/dcom-event-id-10016-is-logged-in-windows

But I’m getting slight variations on the first one, where instead of the SYSTEM account its a service account we are using for an application and the app vendor doesn’t even know if this error should be fixed or not but pointing at it like it might be the cause of the issues we are seeing. =/


Ms say they are normal and should not be worked around.
basically they try a low level access, then a secondary access.
but stupidly continue to log the failure….

Gregg Lee

At step 20 the “group or user name” from the event was not listed.
The user in the event was [my computer name]/[my user account name] (SID-……). so I added it the launch and activation list. Then I checked the Local Activation permission, etc.

I speculated that SELF, which was listed, might be the same thing, but I couldn’t find a simple explanation of what SELF stands for so I added the new one,

Kharab Yasser

Thank you so much very helpful.

Jorge Sanchez

Thanks for Sharing.


Thank you! Very detailed steps. Extremely helpful!


thank you very much for this detailed instruction.
very appreciated


Thank you for this guide. I was 70% there but had not logged in as admin to update the security settings in both the regedit module and the dcom.msc. I lost audio (access denied to MS audio device graph server) after some Microsoft updated on July 9, 2019.


Everyone who reads this guide: Access Denied issue was addressed by me in comments farther down, however, I felt I should post it again at the top of the comments section as it is important to note why you get these errors, or are unable to change permissions when you attempt to do so. 1. Access Denied – You MUST run the true admin account to resolve access denied errors. net user administrator /active:yes Logout of your current windows account, and login to the Administrator account (by default no password is set when you enable this account) MAKE SURE you… Read more »


Perfect guide – thank you so much for your hard work!


Hello Friend, Thanks for your guide.

It seems to me that the account that is causing errors on my system is Unavailable SID (Unavailable)

and throughout my permissions, there is an Unknown Account.

very strange bro.


Thank you


Regarding event id 10016

I still appear to have the same problem. I followed your instructions a couple of times to make sure it was correct.

The only difference is in event log One time it is ( to the user JACKR7\Jack) which is my administrator account. and the next it was (NT AUTHORITY\SYSTEM) ?

my issue appears exactly like yours in that it was runtime broker
I also should that in component services under dcom config I have 2 runtimebrokers ?


Mark Ryan

Hi! I just ran into a problem of not being able to create a recovery drive (USB). (Win 10 1803 image version 10.0.17763.316) It kept failing. The event viewer threw out DistributedCOM 10016 errors. I looked around the web to learn two apps were claiming the same something. Possibly an APP was looking to sign in to its own network. I had been trying to get Skype and Skype for Business running individually. Skype for Business was trying to sign in at bootup, set on its startup screen. I unchecked ‘run at startup’ and completed the recovery disk procedure.… Read more »

Art Cabot

I’d hoped we were on to something, but the program associated with the CLSID doesn’t match the one associated with the APPID in the registry. Neither can I find either of them in Component Services. I’m trying to launch a Word macro-enabled document from Task Scheduler.

Darrell Leland

hi! Thanks for this tutorial. I ran into a problem. When I attempted to give the Administrators in step 16 full control I received an error saying Permission denied. I can’t figure out why whatever this is won’t let me change permissions. The error is with Adobe Reader creating thumbnails and crashing.

Marshall Wilensky

I get an “Access is denied.” error on Step 9.


Read my comment farther down, “Access Denied” issue is addressed by me specifically


In step 19 when I click “Edit” I get a Windows security popup that says “One or more of the permission entries attached to Registry Value has an unrecognized or application-specific (callback) type and cannot be displayed. The two options are “Remove” and “Cancel”. “Remove” removes the unrecognized and callback permission entries. Should I click “Remove” or is there a problem elsewhere I need to fix? Everything seemed to track until this point. If I click “Cancel” then the Security tab has “SELF” which shows Local Launch and Local Activation already checked (which I’d think is what I want since… Read more »


Help having this same issue, should I remove or cancel?

Hans van Woerden

I chose remove, and then set the right permission. Problem and error in event log were gone!


Click Remove


Can anyone explain what this Event Viewer error actually is and what am I giving full control to? I’ve been having major issues with Ghost Recon Wildlands and noticed this particular Event Viewer log entry seems to be time right around when the game crashes to desktop


Per Microsoft, there is no need to fix this error. Read this: https://support.microsoft.com/en-us/help/4022522/dcom-event-id-10016-is-logged-in-windows-10-windows-server “These 10016 events are recorded when Microsoft components tries to access DCOM components without the required permissions. In this case, this is expected and by design. A coding pattern has been implemented where the code first tries to access the DCOM components with one set of parameters. If the first attempt is unsuccessful, it tries again with another set of parameters. The reason why it does not skip the first attempt is because there are scenarios where it can succeed. In those scenarios, that is preferable.” If… Read more »


Microsoft would be wrong. DCOM errors cause random and unpredictable issues with software, such as crashes, even driver crashes.

Remember Microsoft is the one who caused this error because they are to lazy to fix the permission issues themselves.

DCOM errors can return after major windows updates or cumulative updates.

Suppressing these errors does not fix the software crashes these errors cause.


THANK YOU FlukeLSX. I only got to this article through a google search, after my AutoHotKey script inexplicably dies on me when reconnecting an eGPU (external graphics) to my laptop. Or more specifically, a program (altdrag) I started *from within* an AHK script using the RunAs command to get the run as administrator prompt. I think what happens is for some reason, when I hook up this laptop to my 4k monitor setup and its smaller, internal display shuts off, something goes haywire with the DCOM. The Autohotkey script wasn’t running as admin, but I was using it to start… Read more »


A million thanks.

One note. In my case the “Local Activation” permission were needed for LOCAL SERVICE, not SYSTEM. It was not listed in the Security tab of the Component Service in question (ShellServiceHost, for me). So, I just clicked the Add button and added it to the list, checked Allow for Local Activation, and boom, problem solved.

Let’s make that a million and one thanks.


Step 19 ‘edit’ caused an error with grey buttons. (Using app name & id from step 3) I had to change permissions for the app name (RuntimeBroker) with regedit using the app id as a key with permision & user from step 1. This released the step 19 ‘edit’ error.


Then go to Component services step 18.


I’m having the same problems. Can you please elaborate on these instructions as I’m finding them hard to follow and I don’t want to involve guess work in allowing permissions.


helped me a lot!


spot on. don’t forget to change the Owner first, otherwise the second option won’t be possible.

Paul Paul

i could follow until step 20. When i get there the ADD button is grayed out. What Can i do ?


First part worked fine. When I got to Component Services, nope. I did not have the SYSTEM to set up authorization. I had SELF, ALL APPLICATION PACKAGES and Account Unknown (is that by any change my notebook computer with which I’m currently sharing files?)


Error is gone. Now my event log looks a lot cleaner. Thanks!


Did not help me. I have 2 files RuntimeBroker. the first can not be changed, the second I changed but the error did not go away. Im go from 7 to 10

Bob Wilson

Leo, You are not alone. I spent a lot of time reading this thread. Since I am not completely family with editing my Regedit files, I really took care following your advice; messing up Regedit files can create serious system problems, especially change permissions. When I arrived at your FINAL step, running Runtime Broker in ADMIN, I too was unable to make the suggested changes. I received an error stating I was not authorized to make this change (again, I was running Runtime Broker as admin). At this point I am concerned, and like many others my system is still… Read more »


Read my most recent post at the top


Thanks so much this solved the problem. The only extra step I had to do was log off and log back on again


Great article…helped me a lot . Thanks a ton..


Thanks a lot for this fix. I can tell it took quite a bit of time to put together.



thx a lot for the step by step guide.

I did follow it and , although the error 10016 is still there the computer does not freeze anymore.


Hi, I followed the steps above and I get to the last step and the same error as Michael Linder. I too have 2 “Runtime Brokers” and 2 “rundll32.exe” Please help

Michael Linder

Have spent YEARS doing this Microsoft dirty laundry. Now, a new wrinkle. My error is identical to yours, but I have two Runtime Broker entries in Component Services. Doesn’t matter. In both cases, attempting to edit permissions for one or both return this error… “One or more of the permission entries attached to Registry Value has an unrecognized type and can not be displayed” None of the options for Launch, Access or Configuration can be altered in the Permissions or Advanced windows, Everything is locked or grayed-out. There are three Group/User entries under Security: All Application Packages, Self, and Account… Read more »

Kyla B

I have exactly this same problem, did anyone figure it out? Thanks


Same as Kyla

Jason Walker

For anyone having the problem of seeing two instances of the AppID in DCOMCNFG, hit the View->Detail at the top to display both the Name and the Application ID (GUID) fields.


Read my most recent post at the top.


I’ve done all the steps, but I still get this error msg for the specified user account.
One thing I noticed when I took ownership of one registry key, it said that it could not apply the security settings, despite I had ownership…


You think you have ownership but, if you’re using Windows 10 you may not have. I was using this information (gratefully) but having no success either. I was not allowed to save permissions and I am supposed to be my own computer’s MASTER. However, I bought a computer with Windows 10 already installed on it and, after days of research I discovered that my administrator user account has to be enabled for me to have administrative rights. Administrative rights to the owner are turned OFF by default. With little else left for me to try I went tip-toe-ing around outside… Read more »


Thank you for this contribution to my site, Sara.
It took me some time to write down the complete guide, but I am glad I could help most of my visitors.


No no, Christian, thank YOU for assembling the whole thing. There is a paucity of information about this error fixing available and there is nothing to guide you through Component Services even though the error messages tell you that you should go there to fix things. Like that’s going to help anybody at all who doesn’t know all the steps you have to go through first. I just wish I had found your guide SOONER!


Thx @Sara but what is the “door”?


I will rename my first born after you.


While I can take ownership, when I attempt to alter permissions and take full control, I get an error that says unable to alter permission changes


Thanks very much. I had been troubled by that one for a while. Great write up and easy to do.


I was wondering if you had them come back after doing the write up. Mine came back a few hours later. I went through all the steps and double checked everything, but now I’m really stumped.



Great guide by the way. I posted it on the MS answers site since those tools don’t have a clue wtf is going on most of the time.

Also suggestion: Make sure you note: These changes have to be done from the True Admin account, because users don’t have the correct permissions to change permissions. More-so on Windows 8 and 10.

The error they get is “Access Denied.” That’s when I figured out the true admin account must be used.


The other issue they get is what Neklan stated, where they can’t add an account like SYSTEM, LOCAL SERVICE…etc.

They need to run in the true admin account.


Thank you so much for the detailed explanation. The only thing that was different for me was that at the last step. When I had to enable for “SYSTEM” it was not shown, and the add button was disabled. Instead, I chose “use default” for the “Launch and Activation Permissions” then went back into customize/edit and verified that SYSTEM then had the permissions.


I get best results deleting the CLSID and AppID.


Care to elaborate, I got my laptop a few days ago and I’d like to solve this issue. But many persons are running into access issues following the instructions

Would love your thoughts, please comment.x