Fix CO_E_FAILEDTOOPENPROCESSTOKEN 0X8001013C

I know seeing 0X8001013C—especially when you're in the middle of deploying a critical service—makes you want to throw your keyboard. It's that COM error that looks like a system-level disaster but is usually a permissions hiccup. Let's fix it.

The Fastest Fix: Adjust DCOM Launch & Activation Permissions

In 90% of cases, this error pops up because the user account running your client app doesn't have Launch or Activation permissions for the COM server it's trying to talk to. Here's the exact steps:

Press Win + R, type dcomcnfg, hit Enter.
Go to Component Services > Computers > My Computer > DCOM Config.
Find the COM server that's throwing the error. If unsure, check the Event Viewer logs (more on that below). Right-click it, choose Properties.
Go to the Security tab.
Under Launch and Activation Permissions, select Customize, then click Edit.
Click Add, type the user or group that needs access (e.g., NETWORK SERVICE or IIS APPPOOL\YourAppPool).
Grant Local Launch and Local Activation at minimum. Remote permissions only if the client is on another machine.
Click OK all the way out. Reboot the service or the machine.

That's it. Test the client again. This fix resolves 0X8001013C quicker than anything else I've tried.

Why This Works

The error code translates to "failed to open the process token." The COM runtime is trying to impersonate the client's identity when the server starts, but it can't open the server process's access token because the security context is incomplete or denied. By granting explicit Launch and Activation permissions, you're telling COM, "This user is allowed to start that server." Without that, COM blocks the token opening and throws 0x8001013C.

I've seen this a lot with custom COM+ applications and third-party services that run under a specific service account. The default permissions only include Administrators, SYSTEM, and Interactive User—so any service account or non-admin user gets slapped with this error.

Less Common Variations & Deeper Fixes

Variation 1: The Account Lacks Impersonation Privilege

Sometimes the Launch permissions are set, but the client account doesn't have the Impersonate a client after authentication privilege. This is a Group Policy setting. Check it in Local Security Policy > Local Policies > User Rights Assignment. Add the account if missing. I've hit this on locked-down Terminal Servers.

Variation 2: The Server Process Is Already Running as SYSTEM

If the COM server is a system-level process (like svchost.exe hosting a COM service), the token might be highly privileged and the client can't duplicate it. One workaround: configure the COM server to run under a less privileged account in its Properties > Identity tab. Not always possible, but worth checking.

Variation 3: Corrupted Security Descriptor for the AppID

Rare, but I've seen it. The registry key for the AppID (HKEY_CLASSES_ROOT\AppID\{GUID}) might have a broken ACL. Use sc sdshow [ServiceName] to check the service's security descriptor. If it's garbage, reset it using sc sdset with the correct SDDL. Backup the original first!

Preventing This Error in the Future

Use a dedicated service account for your COM server. Avoid built-in accounts like LOCAL SERVICE if the client is remote—those often cause token issues.
When installing new COM components, immediately check the DCOM security tab. Don't assume defaults work for non-admin clients.
Monitor Event Viewer under Windows Logs > System. Filter by source DCOM. Look for event IDs 10010 (server didn't register with DCOM) or 10016 (permission failures). Those pinpoint the exact COM server and user.
Document permissions in your deployment scripts. Use PowerShell Set-DcomPermission cmdlet (available in newer Windows versions) or wmic for older systems to automate the ACL setup.

That's everything I've learned from years of wrestling with 0x8001013C across Windows Server 2012 R2 through 2022. If this fix didn't work for you, check the client account's impersonation level—sometimes it's set to Anonymous instead of Identify. That tripped me up the first time too.