Log Name: System\r\n Source: Microsoft-Windows-DistributedCOM\r\n Date:\r\n Event ID: 10016\r\n Task Category: None\r\n Level: Error\r\n Keywords: Classic\r\n User: DESKTOP-JKJ4G5Q\\ramesh\r\n Computer: DESKTOP-JKJ4G5Q\r\n Description:\r\n The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID\r\n {D63B10C5-BB46-4990-A94F-E40B9D520160}\r\n and APPID\r\n {9CA88EE3-ACB7-47C8-AFC4-AB702511C276}\r\n to the user DESKTOP-JKJ4G5Q\\ramesh SID (S-1-5-21-***) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.<\/pre>\nThe application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID \r\n{D63B10C5-BB46-4990-A94F-E40B9D520160}\r\n and APPID \r\n{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}\r\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.<\/pre>\nThe most common Event ID: 10016 errors reported by users are:<\/p>\n
Immersive Shell\r\n GUID\u00a0 : {C2F03A33-21F5-47FA-B4BB-156362A2F239}\r\n APPID : {316CDED5-E4AE-4B15-9113-7055D84DCC97}\r\n\r\nRuntimeBroker\r\n GUID\u00a0 : {D63B10C5-BB46-4990-A94F-E40B9D520160}\r\n APPID : {9CA88EE3-ACB7-47C8-AFC4-AB702511C276}<\/pre>\nThese event log error entries appear\u00a0if certain processes do not have permissions to the DCOM components mentioned in the event logs. Despite these errors, the system may be functioning well without any major issues, and in that case the errors can be ignored<\/strong> safely. As they say\u00a0“If it ain’t broke, don’t fix it<\/strong><\/em>“, if the system is functioning fine anyway, simply ignore the DCOM errors.<\/p>\nWorkaround for Windows.SecurityCenter DCOM Event ID 10016<\/h3>\nLog Name: System\r\nSource: Microsoft-Windows-DistributedCOM\r\nDate: \r\nEvent ID: 10016\r\nTask Category: None\r\nLevel: Warning\r\nKeywords: Classic\r\nUser: SYSTEM\r\nComputer: DESKTOP-JKJ4G5Q\r\nDescription:\r\nThe application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID \r\nWindows.SecurityCenter.WscBrokerManager\r\n and APPID \r\nUnavailable to the user NT AUTHORITY\\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.\r\n\r\n\r\nLog Name: System\r\nSource: Microsoft-Windows-DistributedCOM\r\nDate: \r\nEvent ID: 10016\r\nTask Category: None\r\nLevel: Warning\r\nKeywords: Classic\r\nUser: SYSTEM\r\nComputer: DESKTOP-JKJ4G5Q\r\nDescription:\r\nThe application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID \r\nWindows.SecurityCenter.SecurityAppBroker\r\nand APPID \r\nUnavailable\r\nto the user NT AUTHORITY\\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.\r\n\r\nLog Name: System\r\nSource: Microsoft-Windows-DistributedCOM\r\nDate: \r\nEvent ID: 10016\r\nTask Category: None\r\nLevel: Warning\r\nKeywords: Classic\r\nUser: SYSTEM\r\nComputer: DESKTOP-JKJ4G5Q\r\nDescription:\r\nThe application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID \r\nWindows.SecurityCenter.WscDataProtection and APPID\r\nUnavailable\r\nto the user NT AUTHORITY\\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.\r\n<\/pre>\nFor the above Windows.SecurityCenter related errors, setting the Security Center service (wscsvc<\/code>) to Automatic start instead of Automatic (delayed start) seems to prevent the DCOM errors. To set the Security Center service (wscsvc<\/code>) to Automatic<\/strong> start, set the DelayedAutoStart<\/code> DWORD value to 0<\/code> in the following registry key:<\/p>\nHKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\wscsvc<\/pre>\n![\"dcom](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/11\/dcomncfg-wscsvc-delayed-start-zero.png\")
<\/p>\n
\nSimply ignore the DCOM errors<\/h4>\n
As per Microsoft:<\/p>\n
![\"\"](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/08\/information-icon.png\")
These 10016 events are recorded when Microsoft components try to access DCOM components without the required permissions. In this case, this is expected and by design<\/strong>.<\/em><\/p>\nA coding pattern has been implemented where the code first tries to access the DCOM components with one set of parameters. If the first attempt is unsuccessful, it tries again with another set of parameters. The reason why it does not skip the first attempt is because there are scenarios where it can succeed. In those scenarios, that is preferable.<\/p>\n
For more information see Microsoft article DCOM event ID 10016 is logged in Windows 10, Windows Server 2016 and Windows Server 2019<\/a>. Microsoft suggests creating a filter (XML source provided in the article) to hide the DCOM 10016 events.<\/em><\/p>\nSuppress DCOM 10016 events using this filter<\/h4>\n<QueryList>\r\n <Query Id=\"0\" Path=\"System\">\r\n <Select Path=\"System\">*<\/Select>\r\n <Suppress Path=\"System\">\r\n *[System[(EventID=10016)]]\r\n and\r\n *[EventData[\r\n (\r\n Data[@Name='param4<\/em>'] and Data='{D63B10C5-BB46-4990-A94F-E40B9D520160}' and\r\n Data[@Name='param5<\/em>'] and Data='{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}' and\r\n Data[@Name='param8<\/em>'] and Data='S-1-5-18'\r\n ) \r\n or\r\n (\r\n Data[@Name='param4<\/em>'] and Data='{260EB9DE-5CBE-4BFF-A99A-3710AF55BF1E}' and\r\n Data[@Name='param5<\/em>'] and Data='{260EB9DE-5CBE-4BFF-A99A-3710AF55BF1E}'\r\n ) \r\n or\r\n (\r\n Data[@Name='param4<\/em>'] and Data='{C2F03A33-21F5-47FA-B4BB-156362A2F239}' and\r\n Data[@Name='param5<\/em>'] and Data='{316CDED5-E4AE-4B15-9113-7055D84DCC97}' and\r\n Data[@Name='param8<\/em>'] and Data='S-1-5-19'\r\n )\r\n or\r\n (\r\n Data[@Name='param4<\/em>'] and Data='{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}' and\r\n Data[@Name='param5<\/em>'] and Data='{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}' and\r\n Data[@Name='param8<\/em>'] and Data='S-1-5-19'\r\n ) \r\n ]]\r\n <\/Suppress>\r\n <\/Query>\r\n<\/QueryList><\/pre>\n\n- Open Event Viewer. Expand Windows Logs \u2192 System.<\/li>\n
- Click Filter current log…<\/strong><\/li>\n
- Select the XML tab and enable Edit query manually<\/li>\n
- Copy\/Paste the above XML to the filter dialog, and click OK.<\/li>\n<\/ol>\n
The DCOM error entries with the Event ID 10016 are now hidden from view.<\/p>\n
![\"dcom](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/11\/dcomncfg-filter-event-log.png\")
<\/p>\n<\/div>\n
If, on the other hand, some app or feature (eg., Cortana) is not working correctly due to incorrect DCOM permissions, here is how to fix it.<\/p>\n
Fix DCOM Permissions Using Registry Editor & DCom Config<\/h2>\n
To prevent the events from being logged, follow these steps to grant permission to the DCOM components that have specific CLSIDs and APPIDs.\u00a0Let’s take the case of\u00a0RuntimeBroker, whose CLSID as reported in the event log is {D63B10C5-BB46-4990-A94F-E40B9D520160}<\/code> APPID is {9CA88EE3-ACB7-47C8-AFC4-AB702511C276}<\/code><\/p>\nImportant:<\/strong> Before proceeding, create a System Restore point<\/a> as incorrectly configuring DCOM Permissions can break<\/strong> Windows. It’s advisable to take a complete image backup if that’s feasible.<\/p>\n
![\"runtimebroker](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/11\/runtimebroker-clsid.png\")
<\/li>\n![\"dcomcnfg](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/11\/runtimebroker-dcomcnfg.png\")
<\/li>\n![\"dcomcnfg](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/11\/dcomcnfg-runtimebroker-properties.png\")
Note that if the Edit button is grayed out in RuntimeBroker application Properties page in DCOM Config, you’ll need to verify the AppID registry key permissions (redo steps 4-6 above).<\/em><\/li>\n