Accessing Office Word object model through asp.net results in “failed due to the following error: 80070005 Access is denied.”

Question

I have developed a website that allows users to upload office documents then uses the office object model to convert the document to an HTML file that it then displays in an iFrame.

I have, of course, included references to Office.interop.word, and the site works fine on my development machine. When I uploaded it to my production server the site functions fine until I try to upload a document. I initially got a similar error that said "COM object not registered". I realized that Word wasn't installed on my production server. So I installed word and now when the server tries to access the word object model I receive the following error:

Retrieving the COM class factory for component with CLSID {000209FF-0000-0000-C000-000000000046} failed due to the following error: 80070005 Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

I searched the registry for the corresponding CLSID and found a corresponding folder. I added full control to the IUSR_ account and due to the persistence of the error I eventually added full control to "everyone" and ensured these permissions inherited down to the rest of the folder. I then added full control to IUSR_ and again eventually added full control to "everyone" to my microsoft office folder.

I don't know what other permissions to grant and where in order to make this "Access is denied" error go away. I must be granting them in the wrong place, because as far as I know I can't be any more permissive than "Everyone" "Full Control".

Can anyone shed any light?

Answer 1

This worked for me:

1. In the command line put DCOMCNFG
2. Component Services -> Computers -> My Computer -> DCOM Config
3. Find "Microsoft Word 97 - 2003 Document" (If it is missing check if your Word is also 64 bit (if your Windows is) if it is not run mmc comexp.msc /32 instead of DCOMCNFG on step 1 as suggested by Darkseal here)
4. Right click -> Properties
5. Go To Tab Security and Edit the "Customize" radio buttons so that IIS_IUSRS could have rights for launch and access
6. Go to Tab Identity and choose "The interactive user"
7. Apply changes and try again
8. If all this fails, go also to tab "General" and in "Authentication Level" drop down choose "None".

Answer 2

Ok, I resolved this problem with this steps:

1. In the command line put DCOMCNFG
2. Expand Console Root > Component Service > Computers, right-click on My Computer, And Select Properties
3. In the Tab COM Security > Launch and Activation Permissions Click in Edit Default
4. Add the User (Ex. IIS_IUSRS) or service
5. Check Allow Local Launch and Local Activation

Then Excel, Word and other applications can work, good luck.

Answer 3

Look in the Event Viewer, under Windows Logs, System, on the server machine where Word is installed. Do you see an event logged that reads something similar to:

The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {148BEE7F-6123-41EE-8CCA-E390902BD0D8} to the user SomeMachine\SomeUser SID (S-1-5-21-483881670-2168941642-1987552629-1003) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

If so, run DCOMCNFG.EXE, and go to Component Services, Computers, My Computer (or whatever name), DCOM Config (and you can just answer "No" if it asks if you want to fix anything) and if the event log message is for an application, then find it by the name in the event log message, here by item name, and if the event log message is for a CLSID (like the example above) then find it by the CLSID "{148B...}" (that's just a random CLSID I pasted in -- probably it will match your 000209FF... above), and select More actions... Properties, to the Security tab.

Here, you can select [x] Customize and then Edit, to add permission for the appropriate user account to activate and access the required DCOM application or class.

It's just a guess, but give that a try, or something along these lines (i.e. granting access to the CLSID via DCOMCNFG).

Answer 4

I had my hard times figuring this out using the accepted answer, because the Microsoft Word 97 - 2003 Document record wasn't listed among DCOM Config items. I found the solution in this Technet blog post, where they correctly explained the issue:

It’s important to note that if you install 32-bit Microsoft Office on a 64-bit machine, you may need to use the 32-bit DCOM config manager to view the programs, depending on your operating system.

On x64 operating systems from Windows XP to Windows Server 2008, the 64-bit version of DCOMCNFG.EXE does not correctly configure 32-bit DCOM applications for remote activation. This behavior causes components that are meant to be activated remotely instead being activated locally. This behavior does not occur in Windows 7 and Windows Server 2008 R2 and higher versions.

Ref.: http://msdn.microsoft.com/en-us/library/windows/desktop/ms678426(v=vs.85).aspx

And also suggested to use the following command-line command (instead of DCOMCNFG) as an effective fix:

mmc comexp.msc /32

Which forces loading the 32-bit DCOM config manager instead of the 64-bit one and allows to perform the steps described within the accepted answer. If this still doesn't work, the article also explains a number of other possible workarounds.

For further info regarding this topic, you can also read this post on my blog.

Answer 5

If you cannot find Microsoft Word Application in DCOM

On 64 bit system with 32 bit Office try this:

1. List item
2. Start
3. Run
4. mmc-32
5. File
6. Add Remove Snap-in
7. Component Services
8. Add
9. OK
10. Console Root
11. Component Services
12. Computers
13. My Computer
14. DCOM Config

after that

1. Find "Microsoft Word 97 - 2003 Document" (If it is missing check if your Word is also 64 bit (if your Windows is))
2. Right click -> Properties
3. Go To Tab Security and Edit the "Customize" radio buttons so that IIS_IUSRS could have rights for launch and access
4. Go to Tab Identity and choose "The interactive user" Apply changes and try again
5. If all this fails, go also to tab "General" and in "Authentication Level" drop down choose "None".