5 Replies Latest reply on Nov 18, 2010 8:02 AM by eletlabs

    Multiple 10016 errors in event viewer

      We're finally running mostly error free after working through multiple other problems, now only one remains.

       

      We're logging multiple 10016 errors in Event Viewer under System tab,

       

      Event Type: Error
      Event Source: DCOM
      Event Category: None
      Event ID: 10016
      Date:  11/12/2010
      Time:  4:55:29 PM
      User:  WS10\McAfeeMVSUser
      Computer: WS10
      Description:
      The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
      {0C0A3666-30C9-11D0-8F20-00805F2CD064}

       

      I haven't found much info on this.  Any help appreciated, I'll give whatever other information is necessary.

       

      Thanks,
      Steve
      to the user WS10\McAfeeMVSUser SID (S-1-5-21-4198539878-1453174916-3338422087-1007).  This security permission can be modified using the Component Services administrative tool.

      For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

        • 1. Re: Multiple 10016 errors in event viewer
          Pritish

          Hi,

           

          I have read your post.

           

          Please follow the below steps.

           

          Manually disable the McAfeeMVSUser account on the Domain Controller.

           

          First open the C drive, open program files, McAfee, Managed Virus scan and under that open Agent. In that folder please look for the myUsrsrv version and note it down.

           

          Now, follow the below steps

           

          Click Start, Run, type cmd and click OK.
          Navigate to C:\Program Files\McAfee\Managed VirusScan\Agent.

           

          Type the following command and press ENTER:

           

          myUsrSrvXXX.exe /UnregServer

           

          Please get back to us if the above steps has not resolved the issue.

           

          Regards

           

          Pritish P.

          • 2. Re: Multiple 10016 errors in event viewer

            Perhaps we're using a different version.  Our domain controller is running Windows Server 2008 R2,

             

            The only McAfee folders we have are

            C:\Program Files (x86)\McAfee\Common Framework

            and

            C:\Program Files (x86)\McAfee\VirusScan Enterprise

             

            Steve

            • 3. Re: Multiple 10016 errors in event viewer

              Just moving this over to our Enterprise area for better visibility / attention

              • 4. Re: Multiple 10016 errors in event viewer
                jeffreychirino

                As far as i know, the McAfeeMVSUser is created when installing the McAfee Total Protection software.

                 

                Are you still using this software on the server?

                • 5. Re: Multiple 10016 errors in event viewer

                  I may need to clarify a few things.  I hope this helps.

                   

                  This is a new server, they installed this software on it when they deployed it here, so this is the only version of AV software it's had installed.  Yes, the software is still running on the server.


                  Also, for what it's worth, there are no errors on the server, the errors are only logged in the workstations.  We've had some other issues thus far which we've mostly ironed out, the firewall was blocking ping requests which was causing roaming profile errors, windows time update errors, and a few others.  It looks like those are mostly gone.  After adding an IP range to the firewall, now I'm having to go around, take the computer out of the domain, delete the computer from active directory, and re-join the domain.  So far it seems to work.

                   

                  Steve