Nerfed Tech

Thanks to http://soerennielsen.wordpress.com/2007/04/16/fixing-those-pesky-dcom-event-log-error-10016-in-a-sharepoint-farm-environment/
—–

Fixing those pesky DCOM event log error 10016 in a SharePoint farm environment

Posted by Søren Nielsen under Deployment , SharePoint 2007 , Troubleshooting

I’m responsible for a couple of SharePoint 2007 (MOSS) farms where all SharePoint servers showed the following error in the system event log:

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10016
Date: 1/17/2007
Time: 4:31:48 AM
User: <DOMAIN>\sa_adm
Computer: <SERVER>
Description:

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{61738644-F196-11D0-9953-00C04FD919C1}

to the user <DOMAIN>\sa_adm SID (S-1-5-21-162740987-2502514208-3469184634-1119). This security permission can be modified using the Component Services administrative tool.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

The error would show up at regular intervals in clusters (4-12 at roughly the same time) and there would be a few more with other usernames and other class id’s. I had two fully functional farms with 3 SharePoint servers each and a number of standalone development machines. They all exhibited similar behavior.

The error listed above is that the user running the Central Administration web application doesn’t have access to activate (instantiate) the IIS WAMREG admin Service object (search the registry for the CLSID).

Strangely enough I didn’t observe any functional errors in the farms as a result of these errors – nothing seemed amiss (plenty of stuff didn’t work but none directly related to this).

An important note here is that the service users used in the farm are all standard domain accounts and only given additional local rights by the SharePoint installer and Central Administration (The one exception is that “aspnet_regiis -ga IIS_WPG” was executed after SharePoint install and initial configuration).

The following procedure removes the errors from the event log without compromising the entire security setup (yes, assign administrative rights for the service users would do the trick too) and has been verified by Microsoft consulting services.

On each SharePoint server do the following:

1. Click Start, Click Run, type “dcomcnfg” and click ok
2. Expand Component Services / Computers / My Computer / DCOM Config
3. Right click IIS WAMREG admin Service and choose Properties
4. Click the Security tag
5. Click Edit under Launch and Activation Permissions
6. Click Add
7. In the Select Users, Computers or Groups type computername\WSS_WPG and
   computername\WSS_ADMIN_WPG
8. Click ok
9. In the Permissions for UserName list, click to select the Allow check box
10. Click Ok twice.
11. Go back to the main Component Services window, right click the “netman” node and select Properties
12. Click the security tab
13. Click Edit under Activation Permissions
14. Click Add on the Launch Permissons Dialog
15. Enter “NETWORK SERVICE” in the edit box
16. Click Ok
17. Enable all the checkboxes for the NETWORK SERVICE
18. Click Ok twice
19. Finally, run “IISReset”

That should be it!

A little less event log errors to worry about – there are plenty left on a reasonable complex SharePoint farm…

As a side note: The above error also shows up in other applications as well – I’ve heard about it for exchange servers as well and more applications are probably affected. In that case you’ll need to search the registry for the actual DCOM application and assign the rights to another local group (or username as a last resort).

Usage Log Reporting Problem

Symptoms:

Little to no usage log data when looking at usage reports. Empty Usage Log files in the logging directories.

Problem:

During an upgrade from SPS 2003 to MOSS 2007, we think the usage logging directory was set to “C:\Windows\System32\LogFiles\STS”. This is the old SPS logging area? The ACL for this area did not contain the WSS_ADMIN_WPG or WSS_WPG groups. These groups are needed to give SharePoint access to write to the log file directory.

Solution:

Corrected the Log file directory in Usage Analysis Administration to use the “C:\program files\Common Files\Microsoft Shared\web server extensions\12\Logs” directory. This directory gets the two security groups added to it by the SharePoint installation.