DCOM Error 10021 is logged when you run a WinRM command against a remote computer that has update 936059 applied

When you run a Windows Remote Management (WinRM) command against a remote computer that has update 936059 applied, some errors may be logged in the System log. These errors may resemble the following:

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10021
Date: Date
Time: Time
User: N/A
Computer: TargetComputerName
Description:
The launch and activation security descriptor for the COM Server application with CLSID
{3E5CA495-8D6A-4D1F-AD99-177B426C8B8E}
is invalid. It contains Access Control Entries with permissions that are invalid. The requested action was therefore not performed. This security permission can be corrected using the Component Services administrative tool.

This problem occurs because the update for Windows Remote Management (WinRM) that is included with Microsoft Knowledge Base article 936059 incorrectly sets the security descriptor for the COM Application under the following subkey:

Method 1

You can use the Component Services MMC snap-in to set the correct access control entries. To do this, follow these steps:

1. Click Start, click Run, type DCOMCNFG, and then click OK.
2. Expand Component Services, expand Computers, expand My Computer, and then click DCOM Config.
3. Right-click Microsoft Windows Remote Shell Host, and then Properties.
4. On the Security tab, under Launch and Activation Permissions, select Customize.
5. Click Edit.
6. Assign the following permissions:
   • Everyone - Local Launch and Local Activation
   • Network Service, System, Administrators Group, Interactive - Local Launch, Remote Launch, Local Activation and Remote Activation (all check boxes)

Method 2

If you must deploy this change to multiple computers, you can update the registry value by using a script. To have us create and run this script for you, go to the "Fix it for me" section. If you would rather do this yourself, go to the "Let me fix it myself" section.

Fix it for me

To create and run this script automatically, click the Fix this problem link, click Run in the File Download dialog box, and then follow the steps in this wizard.

Fix this problem
Microsoft Fix it 50161

Note this wizard may be in English only; however, the automatic fix also works for other language versions of Windows.

Note If you are not on the computer that has the problem, you can save the automatic fix to a flash drive or to a CD, and then you can run it on the computer that has the problem.

Now go to the "Did this fix the problem?" section.

Let me fix it myself

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base: To deploy this change to multiple computers, update the registry value by using the following script:

Check whether the problem is fixed. If it is fixed, you are finished with this article. If it is not fixed, you can contact support.

MICROSOFT AND/OR ITS RESPECTIVE SUPPLIERS MAKE NO REPRESENTATIONS ABOUT THE SUITABILITY OF THE INFORMATION CONTAINED IN THE DOCUMENTS AND RELATED GRAPHICS PUBLISHED ON THIS WEBSITE FOR ANY PURPOSE. THE DOCUMENTS AND RELATED GRAPHICS PUBLISHED ON THIS WEBSITE COULD INCLUDE TECHNICAL INACCURACIES OR TYPOGRAPHICAL ERRORS. CHANGES ARE PERIODICALLY ADDED TO THE INFORMATION HEREIN. MICROSOFT AND/OR ITS RESPECTIVE SUPPLIERS MAY MAKE IMPROVEMENTS AND/OR CHANGES IN THE PRODUCT(S) AND/OR THE PROGRAM(S) DESCRIBED HEREIN AT ANY TIME.

For more information about the terms of use, visit the following Microsoft Web site: