Windows 10: DistributedCOM Error.

Although your method is eloquent; I choose to see when all event log errors are generated. Hiding them isn't the same as solving them. Ultimately, when you choose to hide event ID 10016; you are creating a risk in and of itself. In other words, if you can't see the nature of why the error occurred (which can be detrimental) it is the same as not shutting down the DCOM service altogether.


That is why most peoples posts that I come across when they are talking about DCOM errors; they are in general agreement that Event ID DCOM 10016 is usually harmless. I myself, still like to see why they are generated in the first place.

 

I'm running the Spring Creators release version 1803 (OS Build 17133.1). So far I only have one error in the event viewer log that is generated on every boot. It isn't triggered again on restarts, it's triggered from a cold start up; meaning when I first power on the computer.







This is the error generated:

Log Name: System
Source: Microsoft-Windows-DistributedCOM
Date: 4/8/2018 7:14:57 AM
Event ID: 10016
Task Category: None
Level: Error
Keywords: Classic
User: SYSTEM
Computer: DESKTOP-9AETCF4
Description:
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
Windows.SecurityCenter.WscDataProtection
and APPID
Unavailable
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
<EventID Qualifiers="0">10016</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2018-04-08T11:14:57.356700400Z" />
<EventRecordID>2930</EventRecordID>
<Correlation />
<Execution ProcessID="476" ThreadID="2860" />
<Channel>System</Channel>
<Computer>DESKTOP-9AETCF4</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="param1">application-specific</Data>
<Data Name="param2">Local</Data>
<Data Name="param3">Launch</Data>
<Data Name="param4">Windows.SecurityCenter.WscDataProtection</Data>
<Data Name="param5">Unavailable</Data>
<Data Name="param6">NT AUTHORITY</Data>
<Data Name="param7">SYSTEM</Data>
<Data Name="param8">S-1-5-18</Data>
<Data Name="param9">LocalHost (Using LRPC)</Data>
<Data Name="param10">Unavailable</Data>
<Data Name="param11">Unavailable</Data>
</EventData>
</Event>




Is this an error that will have to be sorted out after the official release or does anyone have an idea I can try to fix the generated error?

:)

 

DistributedCOM Error event ID 10016

I have this many so far today:

Error 10/02/2018 17:04:01 DistributedCOM 10016 None

Error 10/02/2018 17:04:01 DistributedCOM 10016 None

Error 10/02/2018 17:04:01 DistributedCOM 10016 None

Error 10/02/2018 17:04:01 DistributedCOM 10016 None

Error 10/02/2018 17:01:28 DistributedCOM 10016 None

Error 10/02/2018 17:00:57 DistributedCOM 10016 None

Error 10/02/2018 16:29:21 DistributedCOM 10016 None

Error 10/02/2018 16:29:21 DistributedCOM 10016 None

Error 10/02/2018 16:29:21 DistributedCOM 10016 None

Error 10/02/2018 16:29:21 DistributedCOM 10016 None

Error 10/02/2018 15:28:36 DistributedCOM 10016 None

Error 10/02/2018 15:28:13 DistributedCOM 10016 None

Error 10/02/2018 15:28:13 DistributedCOM 10016 None

Error 10/02/2018 15:28:13 DistributedCOM 10016 None

Error 10/02/2018 15:28:13 DistributedCOM 10016 None

Error 10/02/2018 13:48:30 DistributedCOM 10016 None

Error 10/02/2018 13:19:46 DistributedCOM 10016 None

Error 10/02/2018 13:18:12 DistributedCOM 10016 None

Error 10/02/2018 13:18:12 DistributedCOM 10016 None

Error 10/02/2018 13:18:12 DistributedCOM 10016 None

Error 10/02/2018 13:18:12 DistributedCOM 10016 None

Error 10/02/2018 13:16:06 DistributedCOM 10016 None

Error 10/02/2018 12:41:20 DistributedCOM 10016 None

Error 10/02/2018 12:41:20 DistributedCOM 10016 None

Error 10/02/2018 12:41:20 DistributedCOM 10016 None

Error 10/02/2018 12:41:20 DistributedCOM 10016 None

Error 10/02/2018 09:28:11 DistributedCOM 10016 None

Error 10/02/2018 09:28:11 DistributedCOM 10016 None

Error 10/02/2018 08:57:56 DistributedCOM 10016 None

Error 10/02/2018 08:56:40 DistributedCOM 10016 None

Error 10/02/2018 08:56:40 DistributedCOM 10016 None

Error 10/02/2018 08:56:40 DistributedCOM 10016 None

Error 10/02/2018 08:56:40 DistributedCOM 10016 None

Error 10/02/2018 08:48:51 DistributedCOM 10016 None

 

Computer Crashing

Computer crashes while in game on Battlefield 1

Here is the log

Error 6/22/2017 4:26:20 PM DistributedCOM 10016 None

Error 6/22/2017 4:26:20 PM DistributedCOM 10016 None

Error 6/22/2017 4:26:20 PM DistributedCOM 10016 None

Error 6/22/2017 4:26:20 PM DistributedCOM 10016 None

Error 6/22/2017 4:26:20 PM DistributedCOM 10016 None

Error 6/22/2017 4:26:20 PM DistributedCOM 10016 None

Error 6/22/2017 4:26:20 PM DistributedCOM 10016 None

Error 6/22/2017 4:26:20 PM DistributedCOM 10016 None

Error 6/22/2017 4:26:20 PM DistributedCOM 10016 None

Error 6/22/2017 4:26:20 PM DistributedCOM 10016 None

Error 6/22/2017 4:26:20 PM DistributedCOM 10016 None

Error 6/22/2017 4:26:20 PM DistributedCOM 10016 None

Error 6/22/2017 4:26:20 PM DistributedCOM 10016 None

Error 6/22/2017 4:26:20 PM DistributedCOM 10016 None

Error 6/22/2017 4:26:20 PM DistributedCOM 10016 None

Error 6/22/2017 4:26:20 PM DistributedCOM 10016 None

Error 6/22/2017 4:26:20 PM DistributedCOM 10016 None

Error 6/22/2017 4:26:20 PM DistributedCOM 10016 None

Error 6/22/2017 4:26:20 PM DistributedCOM 10016 None

Error 6/22/2017 4:26:20 PM DistributedCOM 10016 None

Information 6/22/2017 4:26:14 PM Kernel-General 16 None

Information 6/22/2017 4:26:14 PM Service Control Manager 7026 None

Information 6/22/2017 4:26:07 PM WLAN-AutoConfig 4000 None

Information 6/22/2017 4:26:06 PM Winlogon 7001 (1101)

Information 6/22/2017 4:26:05 PM DHCPv6-Client 51046 Service State Event

Information 6/22/2017 4:26:05 PM Dhcp-Client 50036 Service State Event

Error 6/22/2017 4:26:06 PM BugCheck 1001 None

Error 6/22/2017 4:26:06 PM BugCheck 1005 None

**Post has been moved by the moderator to the appropriate category**

 

This is the subject of many previous TenForums threads. It is a benign error, though, and is not something you MUST fix. Rather, it is something you CAN fix if it bothers you sufficiently to expend the time and effort necessary to do so. It's all discussed in excruciating detail in this 38-page thread on the Performance&Maintenance forum (check thread #2 for the beginnings of the solution/fix): Windows 10 Event ID 10010 and 10016 Errors With DistributedCOM - Windows 10 Forums.
HTH,
--Ed--

 

Yes, thank you for pointing me in a direction I can possibly pursue to correct the problem. I have manually fixed 10016 errors before by granting permissions and altering the registry.

This one has me stumped though because the APPID and SID are unavailable and usually there are two sets of Guid's to work with in order to fix the problem manually.

Since only one is given:

{1B562E86-B7AA-4131-BADC-B6F3A001407E} it doesn't leave me room to grant permissions to anything; yet alone be found in the Component Services Console by another name in order to grant access to Local or any other accounts.

This one is truly going to take some time to sort out, and I'll keep looking.

 

I don't know (and haven't been able to find) a single case where a DCOM error has led to noticeable performance degradation or other stability or reliability issues with Windows 10. Seems like something less that critical priority, in the grand scheme of things. That said, of course, it's your system and you can choose how you want to spend your time and energy on it. Do keep us posted, if you find anything interesting, or figure something useful out. Thanks,
--Ed--

 

Since I put 1803 on my system before it was even offered by Windows Update/Upgrade Assistant; I really don't have much to complain about since I did it at the risk of not knowing if it would be stable or not. So far, so good; and I'll have to wait for the Stackflow errors from other users that have the OS Build 17133.1 on their Windows Home Edition before I can even troubleshoot this one.


Pounding away at the Microsoft support links hasn't yielded anyone reporting this DCOM error yet on Version 1803, or the steps to take in order to fix it. I had zero DCOM errors on my last build, but that took a couple of hours to grant permissions and tweak the registry. Usually Patch Tuesday would get rid of some of them and others were just plain stubborn.


Like I mentioned earlier, this DCOM error is unique in the sense that the error is being generated from the lack of Guid's; not solely because the permissions are granted incorrectly to produce the error. In other words, the error is being generated because something is missing; not because permissions are granted incorrectly.


I'll definitely keep this thread going until I find something.

 

I figured it out:

1- Navigate to ‘HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole’.

2- Delete these four keys if they appear:

DefaultAccessPermission

DefaultLaunchPermission

MachineAccessRestriction

MachineLaunchRestriction.

3. Reboot your computer.

The DCOM error was not generated on a cold boot or restart.

I forgot that when you upgrade your version, the old permissions are granted to the new OS.


No wait...……….. the error is back without a restart or shutdown - I'm going to have to look at this closer I guess.

 

@EyeInTheSky

Here's the Wikipedia description of DistributedCOM (DCOM):

Distributed Component Object Model (DCOM) is a proprietary Microsoft technology for communication between software components on networked computers. DCOM, which originally was called "Network OLE", extends Microsoft's COM, and provides the communication substrate under Microsoft's COM+ application server infrastructure.
The addition of the "D" to COM was due to extensive use of DCE/RPC (Distributed Computing Environment/Remote Procedure Calls) – more specifically Microsoft's enhanced version, known as MSRPC.
In terms of the extensions it added to COM, DCOM had to solve the problems of

• Marshalling – serializing and deserializing the arguments and return values of method calls "over the wire".
• Distributed garbage collection – ensuring that references held by clients of interfaces are released when, for example, the client process crashed, or the network connection was lost.
• It had to combine Hundreds/Tens of Thousands of objects held in the client's browser with a single transmission in order to minimize bandwidth utilization.

One of the key factors in solving these problems is the use of DCE/RPC as the underlying RPC mechanism behind DCOM. DCE/RPC has strictly defined rules regarding marshalling and who is responsible for freeing memory.
DCOM was a major competitor to CORBA. Proponents of both of these technologies saw them as one day becoming the model for code and service-reuse over the Internet. However, the difficulties involved in getting either of these technologies to work over Internet firewalls, and on unknown and insecure machines, meant that normal HTTP requests in combination with web browsers won out over both of them. Microsoft, at one point, attempted and failed to head this off by adding an extra http transport to DCE/RPC called ncacn_http (Network Computing Architecture connection-oriented protocol). This was later resurrected to support a Microsoft Exchange 2003 connection over HTTP.
DCOM is supported natively in Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003, as well as Windows 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2 and Windows Server 2016.


So, now that you have this information, you may want to look at Steve Gibson's Security site at GRC for a more complete history and further explanation of what it is and, using DCOMbobulator, how to take care of it for good.

While you're there, you might want to look around and see what else Steve has provided for the Windows Community. *Smile

 

Thank you for this input. Unfortunately, I have tried running that Dcombobulator before and when I ran it this time I got this:





I seem to recall working with them in the past on another DCOM error. They were unable to help; but I haven't decided whether or not to submit this particular DCOM error because of the virginity of the OS Build.


Also, I know why the Dcombobulator can't explain the nature of the error. The error is being generated because something is missing to alert the protocols to flag the error with a valid APPID or a CLSID at all for that matter!

 

That's a shame, Eye. I'm assuming you've updated from prior Insider Builds:

I think your system is very sick and you should consider a clean install and all that it entails, such as backing up all your data files, and being sure you have keys available to all your software.

It seems that the error you've pegged as causing the DCOM error is also causing DCOMbobulator to de-combobulate. Basically, two patients are telling each other they are sick. There seem to be internal OS errors with Remote Procedure Call service, which is serious. Almost all Windows services depend on the RPC service; if it's sick, the whole machine is sicker.

I know it's a bummer, but sometimes it's best to just bite the bullet, go back to the drawing board and proceed from there to a clean installation. It should take a lot less time than troubleshooting this error.

 

The error didn't show up until I installed Version 1803 OS Build 17133.1...…….so I didn't have two sick patients; I got a sick patient after a OS install.

 

Good explanation on the DCOM & RPC stuff, Wynona. Nice job!
--Ed--

PS: I still have a paid-for copy of SpinRite sitting in my little tub 'o USB flash drives, right in front of me.

 

Hello,

Although I could fix any potential 10016 errors with all previous builds, when I realized that I would have to do it with every new build I abandoned the usual procedure and found an easiest way. What's this? Well it's simple, just force Event Viewer not to log 10016 events. It's better and you are not potentially opening new security holes with the CLSID and AppID and Component services method. I'm still on version 1709 but it should work with build 1803 too.
If interested let me know and I'll drop some extra lines here on how to proceed.
Edit: see if this helps with your 10016 error.
Open Regedit as admin go to HKLM\System\CurrentControlSet\Control\WMI\Autologger then
Locate {1B562E86-B7AA-4131-BADC-B6F3A001407E} which is what your Event Viewer is reporting, it could be under System or Applications, or other branch, you should be able to locate, and at the right pane there is an entry mentionning enabled dword 1.
Select it then Click on Edit - Modify and change that value to 0.
Reboot pc.
Now the error should not be logged in Event Viewer as we told Windows to ignore it.
Enjoy!

Cheers,