Resolving DCOM Event 10016 Errors for SIMATIC NET SServCfg.exe

Overview

Event Viewer on a Windows Server 2003 host running SIMATIC NET PC Software V6.4 together with SIMATIC NCM PC V5.4 SP1 fills with repeated DCOM 10016 entries. The source executable is SServCfg.exe, the SIMATIC NET Configuration Service, registered under CLSID {96B2BC2E-7A2A-4152-9937-AE39765B0749}. The error states that the machine's default authorization parameters do not grant Local Activation to the COM server application for the SID NT AUTHORITY\NETWORK SERVICE (S-1-5-20). OPC and OPC XML-DA traffic still works, but the log noise hides real faults and consumes disk space.

This reference documents the root cause of the 10016 entries on a Server 2003 5.2.3790 SP1 host, the role of SServCfg.exe, the official Microsoft workaround for the 10016 class of error, and the Siemens-specific considerations when the affected COM server belongs to SIMATIC NET.

Problem Details

Event Viewer / Application log on the OPC server repeatedly shows events with the following text (French locale, translated):

Log Name:      Application
Source:        Microsoft-Windows-DistributedCOM
Event ID:      10016
The application-specific permission settings do not grant Local Activation
permission for the COM Server application with CLSID
{96B2BC2E-7A2A-4152-9937-AE39765B0749}
to the user NT AUTHORITY\NETWORK SERVICE (S-1-5-20).
This security permission can be modified using the Component Services
administrative tool.

Key facts captured from the source incident:

• Affected host: Windows Server 2003 Standard Edition, build 5.2.3790, Service Pack 1
• Siemens stack: SIMATIC NET PC Software V6.4 with SIMATIC NCM PC V5.4 SP1
• Triggering service: SServCfg.exe (SIMATIC NET Configuration Service)
• Target SID: S-1-5-20 / NT AUTHORITY\NETWORK SERVICE
• Requested access: Local Activation for the COM server application
• No functional impact reported on the OPC/OPC XML-DA communication itself

Root Cause

DCOM event 10016 is generated when a client process calls CoCreateInstance (or another activation API) against a COM server whose launch and activation ACL does not contain the calling identity. The DCOM subsystem records the denial, returns E_ACCESSDENIED to the kernel-mode SCM, and continues. The actual COM call may still succeed because Windows retries with the Interactive User identity or the calling process is already running.

In the SIMATIC NET environment the calling identity is typically the NetworkService account that hosts the S7/OPC service pool. The CLSID {96B2BC2E-7A2A-4152-9937-AE39765B0749} resolves to SServCfg.exe, the SIMATIC NET Configuration Service that maintains the S7/IE/PN communication configuration store. The 10016 entries reappear every time the service is restarted or a client re-activates the COM object.

Per Microsoft's official documentation, 10016 is logged by Windows when Microsoft components try to access DCOM components without the required permissions; the event is informational and the documented resolution is to grant the missing access through Component Services or to ignore the events. See DCOM event ID 10016 is logged in Windows - Microsoft Learn for the canonical description.

Why Server 2003 is special

Windows Server 2003 pre-dates the consolidated DCOMCNFG UI improvements in later Windows releases. The launch and activation ACLs of COM applications are stored in HKEY_CLASSES_ROOT\AppID\<AppID GUID> and are edited either through Component Services (dcomcnfg.exe) or by direct ACL editing with regedit. Both paths are covered below for the Server 2003 build used in the incident.

Is SServCfg.exe Required?

Yes. SServCfg.exe is the executable for the SIMATIC NET Configuration Service. It hosts the COM classes used by SIMATIC NCM PC Manager and the OPC server to read and write the S7/IE/PN station and connection configuration. If the service is stopped, configuration downloads from NCM PC fail and any OPC tag that depends on a re-read of the project fails to start.

Recommended state on a production OPC/OPC XML-DA host:

• Startup type: Automatic
• Log-on account: LocalSystem or a dedicated domain service account with the privileges listed in the SIMATIC NET V6.4 installation manual
• Status: Running

Disabling the service is therefore not a valid workaround; the DCOM ACL must be corrected instead.

Solution: Grant Local Activation to NETWORK SERVICE

The Microsoft-published workaround is to add the missing Launch and Activation permission for the calling SID to the affected COM application. Two equivalent procedures are described: the GUI path (preferred for first-time fixes) and the registry path (used for scripted rollouts and for SIMATIC NET hosts that run headless).

Prerequisites

1. Log on interactively as a member of the local Administrators group.
2. Have the SIMATIC NET V6.4 installation media available in case a repair-install is required.
3. Close all OPC client applications and stop the SIMATIC NET services to avoid the ACL being read while you are editing it: net stop "S7EPA", net stop "SimaticNet" (or the equivalent service name set by the installer).
4. Open the Event Viewer so you can confirm the new CLSID matches {96B2BC2E-7A2A-4152-9937-AE39765B0749}.

Method 1 - Component Services (dcomcnfg.exe)

1. Click Start → Run, type dcomcnfg, and press Enter to open Component Services.
2. Expand Component Services → Computers → My Computer → DCOM Config.
3. From the View menu enable Details. Right-click the column header and choose to display Application ID.
4. Locate the entry whose Application ID equals {96B2BC2E-7A2A-4152-9937-AE39765B0749} (the friendly name is SServCfg). If the entry is missing, the SIMATIC NET Configuration Service has not been started at least once; start the service from services.msc and refresh.
5. Right-click the entry and choose Properties.
6. On the Security tab, under Launch and Activation Permissions, click Edit.
7. If the dialog warns that the ACL is not editable, you are not running with full administrator token. Re-launch dcomcnfg with elevated rights on Server 2003 by running runas /user:<hostname>\Administrator dcomcnfg from an elevated command prompt.
8. Click Add, type NETWORK SERVICE, validate, and press OK.
9. Tick the Local Activation allow checkbox. Leave the other permissions at their default values.
10. Click OK twice and close Component Services.

Method 2 - Registry ACL (headless or scripted)

1. Open regedit as Administrator.
2. Navigate to HKEY_CLASSES_ROOT\AppID\{96B2BC2E-7A2A-4152-9937-AE39765B0749}. Confirm the (Default) value reads SServCfg.
3. Right-click the AppID key, choose Permissions, click Advanced, and confirm the owner is NT SERVICE\TrustedInstaller or Administrators. If the owner is SYSTEM and the ACL is locked, take ownership first.
4. Use the subinacl tool to push the Launch and Activation ACE: subinacl /keyreg "HKCR\AppID\{96B2BC2E-7A2A-4152-9937-AE39765B0749}" /grant="NT AUTHORITY\NETWORK SERVICE"=LA
5. Alternatively, on hosts where subinacl is not available, export the key, edit the binary ACL with a utility such as SetACL, and re-import.
6. Reboot the host or restart the SIMATIC NET services so the new ACL is read.

Method 3 - Suppress the event (when the events are purely informational)

If OPC and OPC XML-DA traffic are working and the customer does not need the audit entries, the events can be suppressed using the Microsoft-recommended procedure to ignore 10016 entries. See the Microsoft Learn workaround for the registry-based suppression. Suppression should only be applied after the SIMATIC NET service has been validated end-to-end; it is not a substitute for the ACL fix.

Verification

1. Clear the Application log or note the current event count.
2. Restart the SIMATIC NET Configuration Service: net stop "S7EPA", net start "S7EPA", or use services.msc.
3. Force a client activation by opening SIMATIC NCM PC Manager and reading the project, or by running an OPC XML-DA browse on the configured URL.
4. Wait one minute and re-inspect the Application log. No new DCOM 10016 entries with CLSID {96B2BC2E-7A2A-4152-9937-AE39765B0749} should appear.
5. Confirm SIMATIC NET functionality:
   • OPC DA server starts and exposes the expected tag set.
   • OPC XML-DA wrapper responds on the configured HTTP port.
   • S7/IE/PN connections report Connected in NCM PC Diagnostics.
6. Optionally, run dcomperm (from the Windows 2003 Resource Kit) to dump the resolved ACL on the AppID and confirm the ACE for S-1-5-20 with 0x1 (Local Activation) is present.

SIMATIC NET-Specific Considerations

Service accounts used by SIMATIC NET V6.4

SIMATIC NET V6.4 uses several service identities depending on the installed components:

When any of these services runs under NETWORK SERVICE, the host records 10016 entries against their respective CLSIDs. The fix is identical: add NETWORK SERVICE to the Launch and Activation ACL of the affected AppID.

Interaction with NCM PC V5.4 SP1

NCM PC V5.4 SP1 calls the SServCfg COM interface during project download. If the NetworkService identity cannot launch the COM server, the download fails with a generic DCOM error and NCM PC records a project commit failure. Granting Local Activation fixes the download and removes the 10016 entries.

Firmware/Software update path

Siemens has released subsequent SIMATIC NET versions (V7.x, V8.x, V15/V16) where the 10016 noise is reduced because the installers apply the correct ACL during setup. If a Server 2003 host can be retired, migrating to a current SIMATIC NET release on a supported Windows Server eliminates the recurring events. Confirm the current SIMATIC NET version, hotfix level, and supported Windows version in the official Siemens Industry Online Support portal before any upgrade planning.

Troubleshooting Matrix

Diagnostic Commands

# Confirm the CLSID to executable mapping
reg query "HKCR\CLSID\{96B2BC2E-7A2A-4152-9937-AE39765B0749}" /s | findstr /i "LocalServer32 AppID"

# Inspect the AppID ACL owner and current ACEs
reg query "HKCR\AppID\{96B2BC2E-7A2A-4152-9937-AE39765B0749}" /s

# Resolve NETWORK SERVICE SID
whoami /user /upn

# Filter DCOM 10016 events from the last 24 hours
wevtutil qe Application "/q:*[System[EventID=10016 and TimeCreated[timediff(@SystemTime) <= 86400000]]]" /f:text

# Restart the SIMATIC NET Configuration Service and trigger a reactivation
net stop "S7EPA"
net start "S7EPA"

Rollout Checklist

1. Capture the current Application log size and 10016 count as the baseline.
2. Schedule a maintenance window; stop OPC clients and SIMATIC NET services.
3. Apply the ACL change via dcomcnfg on one host and verify the log clears.
4. Export the registry branch to a .reg file or to a subinacl script for the remaining hosts.
5. Re-enable SIMATIC NET services and validate OPC tag read/write.
6. Document the fix in the change record, including the version strings of SIMATIC NET, NCM PC, and Windows Server.

FAQ