Accessing Office Word object model through asp.net results in "failed due to the following error: 80070005 Access is denied."

51

I have developed a website that allows users to upload office documents then uses the office object model to convert the document to an HTML file that it then displays in an iFrame.

I have, of course, included references to Office.interop.word, and the site works fine on my development machine. When I uploaded it to my production server the site functions fine until I try to upload a document. I initially got a similar error that said "COM object not registered". I realized that Word wasn't installed on my production server. So I installed word and now when the server tries to access the word object model I receive the following error:

Retrieving the COM class factory for component with CLSID {000209FF-0000-0000-C000-000000000046} failed due to the following error: 80070005 Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

I searched the registry for the corresponding CLSID and found a corresponding folder. I added full control to the IUSR_ account and due to the persistence of the error I eventually added full control to "everyone" and ensured these permissions inherited down to the rest of the folder. I then added full control to IUSR_ and again eventually added full control to "everyone" to my microsoft office folder.

I don't know what other permissions to grant and where in order to make this "Access is denied" error go away. I must be granting them in the wrong place, because as far as I know I can't be any more permissive than "Everyone" "Full Control".

Can anyone shed any light?

c#
asp.net
vb.net
office-interop
asked on Stack Overflow Aug 13, 2010 by Camenwolf • edited Mar 6, 2013 by John Saunders

6 Answers

61

Ok, I resolved this problem with this steps:

  1. In the command line put DCOMCNFG
  2. Expand Console Root > Component Service > Computers, right-click on My Computer, And Select Properties
  3. In the Tab COM Security > Launch and Activation Permissions Click in Edit Default
  4. Add the User (Ex. IIS_IUSRS) or service
  5. Check Allow Local Launch and Local Activation

Then Excel, Word and other applications can work, good luck.

answered on Stack Overflow Jul 26, 2011 by sur97c • edited Feb 17, 2014 by TimeTrap
47

This worked for me:

  1. In the command line put DCOMCNFG
  2. Component Services -> Computers -> My Computer -> DCOM Config
  3. Find "Microsoft Word 97 - 2003 Document" (If it is missing check if your Word is also 64 bit (if your Windows is) if it is not run mmc comexp.msc /32 instead of DCOMCNFG on step 1 as suggested by Darkseal here)
  4. Right click -> Properties
  5. Go To Tab Security and Edit the "Customize" radio buttons so that IIS_IUSRS could have rights for launch and access
  6. Go to Tab Identity and choose "The interactive user"
  7. Apply changes and try again
  8. If all this fails, go also to tab "General" and in "Authentication Level" drop down choose "None".
answered on Stack Overflow Oct 10, 2014 by gyosifov • edited Jan 3, 2018 by gyosifov
12

Look in the Event Viewer, under Windows Logs, System, on the server machine where Word is installed. Do you see an event logged that reads something similar to:

The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {148BEE7F-6123-41EE-8CCA-E390902BD0D8} to the user SomeMachine\SomeUser SID (S-1-5-21-483881670-2168941642-1987552629-1003) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

If so, run DCOMCNFG.EXE, and go to Component Services, Computers, My Computer (or whatever name), DCOM Config (and you can just answer "No" if it asks if you want to fix anything) and if the event log message is for an application, then find it by the name in the event log message, here by item name, and if the event log message is for a CLSID (like the example above) then find it by the CLSID "{148B...}" (that's just a random CLSID I pasted in -- probably it will match your 000209FF... above), and select More actions... Properties, to the Security tab.

Here, you can select [x] Customize and then Edit, to add permission for the appropriate user account to activate and access the required DCOM application or class.

It's just a guess, but give that a try, or something along these lines (i.e. granting access to the CLSID via DCOMCNFG).

answered on Stack Overflow Aug 25, 2010 by Jim Flood
6

I had my hard times figuring this out using the accepted answer, because the Microsoft Word 97 - 2003 Document record wasn't listed among DCOM Config items. I found the solution in this Technet blog post, where they correctly explained the issue:

It’s important to note that if you install 32-bit Microsoft Office on a 64-bit machine, you may need to use the 32-bit DCOM config manager to view the programs, depending on your operating system.

On x64 operating systems from Windows XP to Windows Server 2008, the 64-bit version of DCOMCNFG.EXE does not correctly configure 32-bit DCOM applications for remote activation. This behavior causes components that are meant to be activated remotely instead being activated locally. This behavior does not occur in Windows 7 and Windows Server 2008 R2 and higher versions.

Ref.: http://msdn.microsoft.com/en-us/library/windows/desktop/ms678426(v=vs.85).aspx

And also suggested to use the following command-line command (instead of DCOMCNFG) as an effective fix:

mmc comexp.msc /32

Which forces loading the 32-bit DCOM config manager instead of the 64-bit one and allows to perform the steps described within the accepted answer. If this still doesn't work, the article also explains a number of other possible workarounds.

For further info regarding this topic, you can also read this post on my blog.

answered on Stack Overflow May 2, 2017 by Darkseal • edited Oct 19, 2018 by Darkseal
2

If you cannot find Microsoft Word Application in DCOM

On 64 bit system with 32 bit Office try this:

  1. List item
  2. Start
  3. Run
  4. mmc-32
  5. File
  6. Add Remove Snap-in
  7. Component Services
  8. Add
  9. OK
  10. Console Root
  11. Component Services
  12. Computers
  13. My Computer
  14. DCOM Config

after that

  1. Find "Microsoft Word 97 - 2003 Document" (If it is missing check if your Word is also 64 bit (if your Windows is))
  2. Right click -> Properties
  3. Go To Tab Security and Edit the "Customize" radio buttons so that IIS_IUSRS could have rights for launch and access
  4. Go to Tab Identity and choose "The interactive user" Apply changes and try again
  5. If all this fails, go also to tab "General" and in "Authentication Level" drop down choose "None".
answered on Stack Overflow Apr 18, 2016 by çağrı Gündüz • edited Apr 18, 2016 by Benjamin W.
1

In addition to the above, I encountered an issue that I thought I'd share in case other people run into it as well.

The application pool user of my .net app that was using interop was added to Admin but did not take effect due to iis caching environment. After performing the above in addition to an iisreset to reflect proper admin status of the app pool user, everything worked fine.

answered on Stack Overflow Nov 28, 2019 by Jonathan Niu

User contributions licensed under CC BY-SA 3.0