Fix CO_E_TRUSTEEDOESNTMATCHCLIENT (0x80010127) Fast

You're getting error 0x80010127 and it's frustrating because the message says "the client who called IAccessControl::IsAccessPermitted was not the trustee provided to the method." I've seen this many times. Here's the fix.

The Real Fix: Clear the COM Registry Cache

This error pops up most often when you change a service account or a user who runs a scheduled task. The COM system remembers who it trusts. When that person or service changes, it throws this error.

1. Open Services.msc (press Windows key, type "services", hit Enter).
2. Find the service that's giving the error. If you don't know which one, look at the app that crashed. For example, if it's a backup tool, find that service.
3. Right-click the service, choose Stop. Leave the window open.
4. Open Regedit (Windows key, type "regedit", right-click Run as Administrator).
5. Go to:

   Computer\HKEY_CLASSES_ROOT\AppID\{GUID}\

   But you need the right GUID. Let me tell you an easier way.
6. Hit Ctrl+F in Regedit, search for the service name or the app name from the error. Look for a key that has an AppID (not the AppID itself, but a subkey).
7. Once you find the AppID key (it looks like a GUID, like {12345678-1234-1234-1234-123456789012}), delete the whole key.
8. Close Regedit.
9. Back in Services, right-click the service and choose Start.

After you restart the service, the error should be gone. Test by doing whatever caused the error before.

What to expect after deleting the key

Don't worry—Windows rebuilds that registry key automatically the next time the service starts. You're not breaking anything permanent. The cache clears, and the program re-registers with the correct trustee.

Why This Works

The COM (Component Object Model) system caches security info in the registry. When a program calls IAccessControl::IsAccessPermitted, it checks if the current user matches the cached trustee. If those don't match—because you changed a service account, or the app ran under a different user before—it throws 0x80010127.

Deleting the cache forces COM to forget the old trustee. On restart, it rebuilds the entry using the current user or service account. This fixes the mismatch.

I've seen this on Windows 10 version 22H2 and Windows 11 23H2. It happens a lot with backup software like Acronis and Veeam when someone changes the service logon account.

Less Common Variations

Variation 1: The Program Runs as a Scheduled Task

If the error comes from a scheduled task (check Task Scheduler), the fix is similar. Stop the task, delete the AppID key, then restart the task. The key will be under the same HKEY_CLASSES_ROOT\AppID path, but the GUID matches the task's COM component.

Variation 2: Multiple Services Share the Same AppID

Sometimes two services share the same COM AppID. Deleting the key will affect both. After restart, both should work. If one still fails, reboot the whole machine. That rebuilds everything cleanly.

Variation 3: The Error Happens on a Remote Machine

If you're getting this error over a network (remote COM call), check both machines. The registry fix needs to happen on the machine hosting the COM component, not the one calling it. The trustee mismatch is always on the server side.

Variation 4: You Can't Find the AppID in Regedit

If searching by service name doesn't work, look at the exact error message. Sometimes it includes a GUID or program name. Search for that instead. If you still can't find it, use Process Monitor (Procmon) from Microsoft Sysinternals. Filter by the process name and look for RegQueryValue or RegOpenKey calls that fail. That tells you the exact key.

Prevention

Once you fix it, here's how to stop it from coming back:

• Don't change service accounts unless you really need to. If you must, stop the service first, change the account, wait 10 seconds, then start it again. This clears the cache cleanly.
• When installing software that uses COM (like backup tools, remote management, or automation), always run the installer with the same user account that will run the service. Don't install as admin and then switch to a service account.
• If you use Group Policy to push software, make sure the policy runs under the same security context as the app. I've seen domain policies cause this when they deploy software that runs as SYSTEM but the machine was rebooted by a user.

That's it. One registry delete, restart the service, and you're done. No need to reboot the whole machine in most cases.