What does HRESULT 0x80110823 (COMADMIN_E_REGISTRY_ACCESSDENIED) mean?

 
Previous Next
COMADMIN_E_SAFERINVALID COMADMIN_E_PARTITIONS_DISABLED

COMADMIN_E_REGISTRY_ACCESSDENIED

COMADMIN_E_REGISTRY_ACCESSDENIED is the failure HRESULT 0x80110823 (signed decimal -2146367453, unsigned decimal 2148599843). Its severity bit is 1, facility is 17 (FACILITY_ITF), and the facility-specific code field is 0x0823.

Registry-write authorization during COM+ administration: exact meaning of COMADMIN_E_REGISTRY_ACCESSDENIED

COM+ determined that the specified or effective user cannot write the system registry entries required by the operation. The catalog presents a unified view but still uses Windows registry data for classes, type libraries, interfaces, and proxy/stub registration.

AllStat records the Windows SDK description as “The specified user cannot write to the system registry”.

Where COMADMIN_E_REGISTRY_ACCESSDENIED occurs

The failure occurs during installation, copy/move, configuration, or registration work when persistent registry changes are required. Interactive success under another account does not validate the service or remote COMAdmin identity.

Typical cause branches

  • the deployment/service account lacks write access to the required registry keys.
  • remote COM authentication or impersonation prevents the server from using the expected token.
  • registry keys have nonstandard ACLs inherited from an old installer or hardening policy.
  • the operation targets a protected architecture view or system registration owned by another installer.

Evidence to collect before changing the catalog

  • effective server-side SID/token, elevation, integrity level, and impersonation level.
  • exact registry path and 32/64-bit view from Procmon/event/ErrorInfo evidence.
  • current ACL/owner and the installer/product responsible for the key.
  • COMAdmin method, AppID/CLSID/TypeLib, remote target, and operation timing.

Diagnostic sequence for COMADMIN_E_REGISTRY_ACCESSDENIED

  • identify the first denied registry write under the real execution identity.
  • compare the key ACL with a healthy machine or owning installer expectations.
  • correct only the required permission or repair the owning installation.
  • rerun the supported COMAdmin/installer operation rather than creating registry fragments manually.
  • verify both catalog and registry registration after completion.

Retry and recovery

Retry only after token or ACL state changes. Repeated writes under the same denied identity cannot succeed and may hide the first failing path.

What this HRESULT does not establish

The code does not justify granting broad Full Control to the registry or running every deployment as LocalSystem. Find the exact key and owning workflow.

Difference from nearby COMADMIN results

COMADMIN_E_PARTITION_ACCESSDENIED concerns partition authorization; COMADMIN_E_NOREGISTRYCLSID concerns missing class registration. This value specifically reports inability to write required registry state.

Practical administration scenario

A remote deployment service can read the COM+ catalog but its impersonated token is denied while writing a CLSID registration key protected by a custom ACL.

Developer and operations guidance

Record effective SID/token attributes, remote/local path, denied key and registry view, desired access, CLSID/AppID/TypeLib, ACL owner, and correlated audit event.

Official Microsoft references for COMADMIN_E_REGISTRY_ACCESSDENIED

Looking for a different code? Search another status or error code.