Fix 0X8000401A: COM+ Server Identity Wrong in Windows

When You See This Error

You're running a Windows Server (2016, 2019, or 2022) with a custom COM+ application—maybe one you built in-house or a third-party service that uses COM+ components. The application works for a while, then suddenly stops. When you check the Windows Event Viewer, you see an application log entry with source COM+ and event ID 4211, description: "The server process could not be started because the configured identity is incorrect. Check the DCOM and COM+ application configuration to see if the identity is valid." The error code is 0X8000401A.

This commonly happens after you change the password of the service account that the COM+ application runs under. Or when you move the server to a new domain and the old account no longer exists. Even a temporary lockout of that account can trigger it.

Root Cause in Plain English

COM+ applications run under a specific identity—usually a domain user account, a local account, or the built-in "Interactive User" (which logs in as whoever is logged on to the console). When that identity's credentials are wrong, or the account can't log on for some reason, the COM+ runtime can't start the server process. It throws 0X8000401A and the app fails.

The fix is to update the identity in the COM+ application's properties. You have three options:

• Use a valid domain account with the correct password.
• Use Interactive User if the app only needs to run when someone is logged on.
• Use Local Service or Network Service if the app doesn't need a specific account.

My recommendation: if the app is a service that runs 24/7, don't use Interactive User—it stops working when nobody's logged in. Use a dedicated service account with a strong password and never expiry.

Step-by-Step Fix

You'll need administrative rights on the server. Don't skip the backup step—it's saved me more than once.

1. Open Component Services. Press Win + R, type dcomcnfg, and press Enter. If UAC prompts, click Yes.
2. Backup the COM+ application. In the left pane, expand Component Services > Computers > My Computer > COM+ Applications. Right-click your application (the one that's failing) and select Export. Choose "Application proxy" or "Full export"—full export is better. Save the .msi file somewhere safe. This way you can restore if you mess up.
3. Open the application's properties. Right-click the application name and select Properties.
4. Go to the Identity tab. Click the Identity tab at the top. You'll see a radio button for "Interactive user" and another for "This user".
5. Choose the right identity.
   • If you have a specific service account, select This user, click Browse, type the account name, and click Check Names. Then enter the password twice.
   • If you don't need a specific account and the app runs okay with limited permissions, select Interactive user—but only if you're okay with it failing when nobody logs on.
   • For a lot of internal apps, Local Service works, but you can't set that from this tab. You'd have to edit the DCOM config instead. So stick with the first two.
6. Apply the changes. Click Apply, then OK. You should see a popup saying "The changes will take effect the next time the application starts"—something like that. It doesn't restart it automatically.
7. Restart the COM+ application. In Component Services, right-click your application and select Shut down. Then right-click again and select Start. If the identity is correct, the app starts without error. If you get a popup about "The application is already running", wait a few seconds and try again.
8. Test the application. Try to use the app that was failing. If it works, you're done. If not, move on to the next section.

What to Check If It Still Fails

If you've set the identity correctly and it's still throwing 0X8000401A, here's what to look at:

1. Account Permissions

The account you're using needs the right to log on as a service. Open Local Security Policy (secpol.msc), go to Local Policies > User Rights Assignment, and double-check that the account is listed under "Log on as a service". If not, add it.

2. Password Expiry

If the account's password has expired or is set to change on next logon, it will fail. Reset the password to something permanent and update it in the COM+ properties again.

3. DCOM Configuration

Sometimes the COM+ app's DCOM settings override the COM+ identity. Open dcomcnfg, go to Component Services > Computers > My Computer > DCOM Config. Find the DCOM entry for your app, right-click, select Properties, go to the Identity tab, and make sure it matches what you set in COM+.

4. Event Viewer Details

Look at the full event log entry. Sometimes the error message includes more clues, like "logon failure: unknown user name or bad password"—that tells you it's a credential problem. If it says "the specified domain either does not exist or could not be contacted," that's a network/AD issue.

5. Re-register the COM+ App

If nothing else works, you can delete the COM+ application and re-import it from the backup you made. That resets all settings, including the identity. Right-click the app, select Delete, then right-click COM+ Applications and choose New > Application. Follow the wizard, but choose "Install pre-built application" and point to your backup .msi file.

One more thing—if you're running this on a cluster, make sure the service account is valid on every node. I've seen this error pop up on a failover when only one node had the updated password.

That should cover it. The fix is almost always the identity tab. Get that right and the error goes away.