Sharepoint 2010 Event Error 1015 DCOM 10016 Please Help

SharePoint 2010 FARM SP2 64 bit on Windows 2012 R2 Standard 64 bit
Sharepoints database on Windows 2008 R2 Standard 64 bit server with SQL 2008 Enterprise the instance is "SharePoint"

Every day at 12:56 AM I get around 20 - 30 errors in the application log and system log

I checked my SharePoint scheduled jobs

       Central Administration > Monitoring > Job Definitions > Scheduled Jobs

Found this Job "Product Version Job" runs are 12:56 AM

The user account "spserv" is only domain user account

EVENT ID 1015

Log Name:      Application
Source:        MsiInstaller
Date:          5/29/2015 12:52:36 AM
Event ID:      1015
Task Category: None
Level:         Warning
Keywords:      Classic
User:          XXX\spserv
Computer:      SERV013.FQDN.com
Description:
Failed to connect to server. Error: 0x80070005
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MsiInstaller" />
    <EventID Qualifiers="0">1015</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-05-29T04:52:36.000000000Z" />
    <EventRecordID>15905</EventRecordID>
    <Channel>Application</Channel>
    <Computer>SERV013.FQDN.com</Computer>
    <Security UserID="S-1-5-21-3054588571-1341459584-784128302-3140" />
  </System>
  <EventData>
    <Data>0x80070005</Data>
    <Data>(NULL)</Data>
    <Data>(NULL)</Data>
    <Data>(NULL)</Data>
    <Data>(NULL)</Data>
    <Data>(NULL)</Data>
    <Data>
    </Data>
  </EventData>
</Event>

EVENT ID 1035

Log Name:      Application
Source:        MsiInstaller
Date:          5/29/2015 12:52:36 AM
Event ID:      1035
Task Category: None
Level:         Information
Keywords:      Classic
User:          XXX\spserv
Computer:      SERV013.FQDN.com
Description:
Windows Installer reconfigured the product. Product Name: Microsoft Excel Mobile Viewer Components. Product Version: 14.0.7015.1000. Product Language: 0. Manufacturer: Microsoft Corporation. Reconfiguration success or error status: 0.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MsiInstaller" />
    <EventID Qualifiers="0">1035</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-05-29T04:52:36.000000000Z" />
    <EventRecordID>15906</EventRecordID>
    <Channel>Application</Channel>
    <Computer>SERV013.FQDN.com</Computer>
    <Security UserID="S-1-5-21-3054588571-1341459584-784128302-3140" />
  </System>
  <EventData>
    <Data>Microsoft Excel Mobile Viewer Components</Data>
    <Data>14.0.7015.1000</Data>
    <Data>0</Data>
    <Data>0</Data>
    <Data>Microsoft Corporation</Data>
    <Data>(NULL)</Data>
    <Data>
    </Data>
    <Binary>7B39303134303030302D313133382D303030302D313030302D3030303030303046463143457D3030303034356236376339616565623439393730353766646637396434363630323439633030303030303030</Binary>
  </EventData>
</Event>



SYSTEM LOG Exact same time

EVENT ID 10016

Log Name:      System
Source:        Microsoft-Windows-DistributedCOM
Date:          5/29/2015 12:52:36 AM
Event ID:      10016
Task Category: None
Level:         Error
Keywords:      Classic
User:          XXX\spserv
Computer:      SERV013.FQDN.com
Description:
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{000C101C-0000-0000-C000-000000000046}
 and APPID
{000C101C-0000-0000-C000-000000000046}
 to the user XXX\spserv SID (S-1-5-21-3054588571-1341459584-784128302-3140) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
    <EventID Qualifiers="0">10016</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2015-05-29T04:52:36.019631200Z" />
    <EventRecordID>16363</EventRecordID>
    <Correlation />
    <Execution ProcessID="608" ThreadID="4412" />
    <Channel>System</Channel>
    <Computer>SERV013.our.network.tgcsnet.com</Computer>
    <Security UserID="S-1-5-21-3054588571-1341459584-784128302-3140" />
  </System>
  <EventData>
    <Data Name="param1">machine-default</Data>
    <Data Name="param2">Local</Data>
    <Data Name="param3">Activation</Data>
    <Data Name="param4">{000C101C-0000-0000-C000-000000000046}</Data>
    <Data Name="param5">{000C101C-0000-0000-C000-000000000046}</Data>
    <Data Name="param6">OUR</Data>
    <Data Name="param7">spserv</Data>
    <Data Name="param8">S-1-5-21-3054588571-1341459584-784128302-3140</Data>
    <Data Name="param9">LocalHost (Using LRPC)</Data>
    <Data Name="param10">Unavailable</Data>
    <Data Name="param11">Unavailable</Data>
  </EventData>
</Event>



I think it is a security issue but do not know where to start looking


any thoughts?
LVL 23
Thomas GrassiSystems AdministratorAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Thomas GrassiSystems AdministratorAuthor Commented:
Update

I disabled this Job "Product Version Job" that runs are 12:56 AM

now no error messages

So what is wrong with this job?
Mohit NairSenior AssociateCommented:
Please check your SharePoint farm account. Your farm account may not be a part of Local Administrator group. Also check if its added in WSS_WPG and WSS_ADMIN_WPG groups as well.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Thomas GrassiSystems AdministratorAuthor Commented:
Mohit

my farm account is SPFARM

was not in WSS_WPG   added it

I had SPFARM in the local administartors group before but I removed it because of another health report message
saying no service accounts for sharepoint should have a account in the local administrator group.

Thoughts
Protecting & Securing Your Critical Data

Considering 93 percent of companies file for bankruptcy within 12 months of a disaster that blocked access to their data for 10 days or more, planning for the worst is just smart business. Learn how Acronis Backup integrates security at every stage

Mohit NairSenior AssociateCommented:
I know its not recommended by TechNet but to avoid such DCOM errors its an ideal way to give farm admin local access. Please monitor if this issue is recurring.
Thomas GrassiSystems AdministratorAuthor Commented:
Mohit

While I was waiting for help on this I disabled the process  in the timer jobs

I will add spfarm to the local administartors group and turn it back on after I add it I will run another system analize to see if the other message appears again too.

Teamviewer is installed on my server and ready
Thomas GrassiSystems AdministratorAuthor Commented:
Mohit

Just ran the Product Version Job  

No Dcom errors  

Adding Farm Account SPFARM to WSS_WPG WSS_ADMIN_WPG and to local Administrators group  did the trick

Thank you for your help on this.
Mohit NairSenior AssociateCommented:
Glad to hear that !!
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft SharePoint

From novice to tech pro — start learning today.