Windows 10: DCOM Configuration Warning

Hello,

I was fixing a DCOM error and while entering the DCOM Config in Component Services I encountered a "DCOM Configuration Warning" asking me if I would like to record an item.
I clicked "Yes" without fully reading what it asked me to add. I doubt this will have any negative impact on my system however this made me wonder if there was some kind of log or logfile where I could see what item was recorded.

Please excuse me if this is not the right place to post this thread.

Cheers

:)

 

DCOM Configuration Warning

rundll32.exe is a Windows component. This is not a malware / virus. (If this is virus infected, this should get caught by AV loaded on your computer)

You can safely click Yes for this.

If problem related to rundll32.exe happens, you can always run sfc scan -
https://support.microsoft.com/en-us/help/929833...

 

DCOM Configuration Warning

When I open the Component Services Administration tool I'm presented with the following message....

DCOM Configuration Warning!

The CLSID {c82192ee-6cb5-4bc0-9ef0-fb818773790a}, item C:\Windows\System32\rundll32.exe and title JumpViewerExecuteHelper has named value AppID, but is not recorded under \\HKEY_CLASSES_ROOT\Appid. Do you wish to record it?

Is it safe to click 'Yes' or should I click 'No'

I've noticed also in my event logs that I get several of these events each day, not sure if these are related? This is the reason I started looking in the Component Services Administration tool but I feel out of my depth on this one.

Log Name: System

Source: Microsoft-Windows-DistributedCOM

Date: 15/01/2018 12:58:38

Event ID: 10016

Task Category: None

Level: Error

Keywords: Classic

User: LOCAL SERVICE

Computer: ASUS-PC

Description:

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{D63B10C5-BB46-4990-A94F-E40B9D520160}

and APPID

{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}

to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />

<EventID Qualifiers="0">10016</EventID>

<Version>0</Version>

<Level>2</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x8080000000000000</Keywords>

<TimeCreated SystemTime="2018-01-15T12:58:38.466013200Z" />

<EventRecordID>6147</EventRecordID>

<Correlation />

<Execution ProcessID="1092" ThreadID="8476" />

<Channel>System</Channel>

<Computer>ASUS-PC</Computer>

<Security UserID="S-1-5-19" />

</System>

<EventData>

<Data Name="param1">application-specific</Data>

<Data Name="param2">Local</Data>

<Data Name="param3">Activation</Data>

<Data Name="param4">{D63B10C5-BB46-4990-A94F-E40B9D520160}</Data>

<Data Name="param5">{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}</Data>

<Data Name="param6">NT AUTHORITY</Data>

<Data Name="param7">LOCAL SERVICE</Data>

<Data Name="param8">S-1-5-19</Data>

<Data Name="param9">LocalHost (Using LRPC)</Data>

<Data Name="param10">Unavailable</Data>

<Data Name="param11">Unavailable</Data>

</EventData>

</Event>

 

This exact thing happened to me today, would like to know what it means as well.

Pretty sure it's harmless tbh

 

It means you had a CLSID referring to a non-existing AppID. Answering the question you were asked in the positive should cause the corresponding AppID to be created with default settings. However, I found that in some cases this doesn't work, most likely due to a permissions issue (couldn't be bothered to research this). If that is the case you'll see the exact same prompt again next time you open that DCOM pane.

In any case, what this does is to fix an omission, and it won't do any harm one way or another.

 

I gave up fixing these DCOM errors since as someone pointed out we don't really know what we are fixing or indeed whether we are creating new problems trying to fix them. I'd leave it to MS to fix them.