DCOM Error 10021 is logged when you run a WinRM command against a remote computer that has update 936059 applied

Article translations Article translations
Article ID: 959815 - View products that this article applies to.
Expand all | Collapse all

On This Page

Error message description

When you run a Windows Remote Management (WinRM) command against a remote computer that has update 936059 applied, some errors may be logged in the System log. These errors may resemble the following:

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10021
Date: Date
Time: Time
User: N/A
Computer: TargetComputerName
Description:
The launch and activation security descriptor for the COM Server application with CLSID
{3E5CA495-8D6A-4D1F-AD99-177B426C8B8E}
is invalid. It contains Access Control Entries with permissions that are invalid. The requested action was therefore not performed. This security permission can be corrected using the Component Services administrative tool.

CAUSE

This problem occurs because the update for Windows Remote Management (WinRM) that is included with Microsoft Knowledge Base article 936059 incorrectly sets the security descriptor for the COM Application under the following subkey:
HKEY_CLASSES_ROOT\AppID\{3e5ca495-8d6a-4d1f-ad99-177b426c8b8e}\LaunchPermission

RESOLUTION

Method 1

You can use the Component Services MMC snap-in to set the correct access control entries. To do this, follow these steps:
  1. Click Start, click Run, type DCOMCNFG, and then click OK.
  2. Expand Component Services, expand Computers, expand My Computer, and then click DCOM Config.
  3. Right-click Microsoft Windows Remote Shell Host, and then Properties.
  4. On the Security tab, under Launch and Activation Permissions, select Customize.
  5. Click Edit.
  6. Assign the following permissions:
    • Everyone - Local Launch and Local Activation
    • Network Service, System, Administrators Group, Interactive - Local Launch, Remote Launch, Local Activation and Remote Activation (all check boxes)

Method 2

If you must deploy this change to multiple computers, you can update the registry value by using a script. To have us create and run this script for you, go to the "Fix it for me" section. If you would rather do this yourself, go to the "Let me fix it myself" section.

Fix it for me

To create and run this script automatically, click the Fix this problem link, click Run in the File Download dialog box, and then follow the steps in this wizard.

Fix this problem
Microsoft Fix it 50161


Note this wizard may be in English only; however, the automatic fix also works for other language versions of Windows.

Note If you are not on the computer that has the problem, you can save the automatic fix to a flash drive or to a CD, and then you can run it on the computer that has the problem.

Now go to the "Did this fix the problem?" section.

Let me fix it myself

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756 How to back up and restore the registry in Windows
To deploy this change to multiple computers, update the registry value by using the following script:
reg add HKEY_CLASSES_ROOT\AppID\{3e5ca495-8d6a-4d1f-ad99-177b426c8b8e} /v LaunchPermission /t REG_BINARY /d 0100048098000000A400000000000000140000000200840006000000000014000B000000010100000000000100000000000314001F000000010100000000000512000000000314001F000000010100000000000513000000000314001F000000010100000000000514000000000318001F00000001020000000000052000000020020000000314001F00000001010000000000050400000001010000000000051200000001020000000000052000000020020000 /f

Did this fix the problem?

Check whether the problem is fixed. If it is fixed, you are finished with this article. If it is not fixed, you can contact support.

DISCLAIMER

MICROSOFT AND/OR ITS RESPECTIVE SUPPLIERS MAKE NO REPRESENTATIONS ABOUT THE SUITABILITY OF THE INFORMATION CONTAINED IN THE DOCUMENTS AND RELATED GRAPHICS PUBLISHED ON THIS WEBSITE FOR ANY PURPOSE. THE DOCUMENTS AND RELATED GRAPHICS PUBLISHED ON THIS WEBSITE COULD INCLUDE TECHNICAL INACCURACIES OR TYPOGRAPHICAL ERRORS. CHANGES ARE PERIODICALLY ADDED TO THE INFORMATION HEREIN. MICROSOFT AND/OR ITS RESPECTIVE SUPPLIERS MAY MAKE IMPROVEMENTS AND/OR CHANGES IN THE PRODUCT(S) AND/OR THE PROGRAM(S) DESCRIBED HEREIN AT ANY TIME.

For more information about the terms of use, visit the following Microsoft Web site:
http://support.microsoft.com/tou/

Properties

Article ID: 959815 - Last Review: September 11, 2011 - Revision: 4.0
APPLIES TO
  • Microsoft Windows Server 2003 R2 Standard Edition (32-bit x86)
  • Microsoft Windows Server 2003 R2 Enterprise Edition (32-Bit x86)
  • Microsoft Windows Server 2003 R2 Datacenter Edition (32-Bit x86)
  • Microsoft Windows Server 2003 R2 Enterprise x64 Edition
  • Microsoft Windows Server 2003 R2 Standard x64 Edition
  • Microsoft Windows Server 2003 R2 Datacenter x64 Edition
  • Microsoft Windows Server 2003, Standard Edition (32-bit x86)
  • Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
  • Microsoft Windows Server 2003, Web Edition
  • Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
  • Microsoft Windows Server 2003, Standard x64 Edition
  • Microsoft Windows Server 2003, Enterprise x64 Edition
  • Microsoft Windows Server 2003, Datacenter x64 Edition
  • Microsoft Windows XP Professional
Keywords: 
kbfixme kbmsifixme kbexpertiseinter kbtshoot kbprb KB959815

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com