Windows 10: Event 10016 Warnings CLSID {2593F8B9-4EAF-457C-B68A-50F6B8EA6B54} and APPID...

WARNING TO "INDEPENDENT ADVISORS" - if you post on my thread here without answering my question, I will report you to the moderators. Answer my actual question -- without links to your website -- or stay away.


All - On my Win 10 Pro, I recently updated from 1803 to 1903. I continue to get numerous new Event 10016 Warnings about


The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
and APPID
{15C20B67-12E7-4BB6-92BB-7AFF07997402}



As this is a very common problem, from numerous forums, we all now know that the APPID is for the DCOM item PerAppRuntimeBroker.


I thought I might try to add the "missing" permission settings in dcomcnfg. HOWEVER, when I hit the Edit button in Launch and Activation Permissions on the Security tab in Properties for PerAppRuntimeBroker, I got this:



That is a new one on me. I hit Cancel.

Also, I searched regedit for the AppID {15c20b67-12e7-4bb6-92bb-7aff07997402}, and I did not see anything that looked like the mentioned nondisplayable permission entries.

What is this Windows Security warning, and what happens to my life if I hit Remove?

Thanks.


glnzglnz
☺ In the office, Dell Optiplex 7040 with 8GB RAM, Win 7 Pro 64-bit and Office 2010
☻ At home, Dell Optiplex 7010 with 16GB RAM dual-booting Win 7 Pro 64-bit (now with Office 365 Home) and Win 10 Pro 64-bit
♥ Also still have Dell Optiplex 755 with 4GB RAM with Win XP Pro SP3 (which still gets updates with the POS hack) and Office 2003

:)

 

Windows 10 error 10016 from Run-time broker - cannot change permissions

Thanks for the info on HKEY_CLASSES_ROOT\CLSID\{2593f8b9-4eaf-457c-b68a-50f6b8ea6b54}.

It may not have been the right one, but it did have {15c20b67-12e7-4bb6-92bb-7aff07997402} reference in the Data column for the AppID.

I did add Full Control for Administrators to HKEY_CLASSES_ROOT\CLSID\{2593f8b9-4eaf-457c-b68a-50f6b8ea6b54}

Sadly, HKEY_CLASSES_ROOT\AppID\{15c20b67-12e7-4bb6-92bb-7aff07997402} did not change afterwards and

" Unable to save permission changes for {... } Access denied. " still shows up. This one isn't referenced in the Event Viewer DistributedCOM 10016 error message.

I am still getting the errors for the original

HKEY_CLASSES_ROOT\AppID\{9CA88EE3-ACB7-47c8-AFC4-AB702511C276} . This 'solution' didn't seem to work for me. Of the 1,208 errors in the last month, 1,098 are the DistributedCOM errors for this
key. I have noted that the error seems to create an EVENT when switching Account User or the PC comes out of Sleep mode. I'll try to figure out when it happens. It doesn't seem to be causing any grief . Now it is just a puzzle.

 

DISTRIBUTEDCOM Event error 10016


These are the affected DCOM components and keys we find on many systems after updates:

1/ RunTimeBroker - 1st entry

"HKEY_CLASSES_ROOT\CLSID\{2593f8b9-4eaf-457c-b68a-50f6b8ea6b54}"

"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{15c20b67-12e7-4bb6-92bb-7aff07997402}"

2/ RunTimeBroker - 2nd entry

"HKEY_CLASSES_ROOT\CLSID\{D63B10C5-BB46-4990-A94F-E40B9D520160}"

"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}"

3/ ShellServiceHost

"HKEY_CLASSES_ROOT\CLSID\{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}"

"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}"

4/ Windows Management and Instrumentation

"HKEY_CLASSES_ROOT\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}"

5/ Immersive Shell

"HKEY_CLASSES_ROOT\CLSID\{C2F03A33-21F5-47FA-B4BB-156362A2F239}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{316CDED5-E4AE-4B15-9113-7055D84DCC97}"



To fix these issues:

Download SetACL.exe from SetACL - Automate Permissions and Manage ACLs • Helge Klein

Or: See attachment at end of post.

Copy to c:\windows\system32 and make sure you use the appropriate 32 or 64 bit file for your architecture.

Enable the built-in Administrator account, follow these steps:

Open Command Prompt (Admin).

In the elevated Command Prompt, type the following command and then press Enter.

Net user administrator /active:yes


To disable the built-in Administrator account, simply type Net user administrator /active:no in the elevated Command Prompt; but only do this after you have run all your script lines below.

Create text file scripts in this format: (Change CLSID and APPID for each DCOM). In other words, plug your CLSID and AppID alphanumeric lines from your Event Viewer error (10016) between { } in each line below and hit enter after each line is entered in the cmd prompt.

The current CLSID and AppID in the lines below are one of the common DCOM components that need addressed and you can just enter your CLSID or AppID's instead.

Make sure you pay attention to \CLSID\ and \AppID\ in each line below so you plug your alphanumeric codes in right.

Do each script line one at a time, hitting "Enter" after each line:


reg query "HKEY_CLASSES_ROOT\CLSID\{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}" /ve

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{15C20B67-12E7-4BB6-92BB-7AFF07997402}" /ve


SetACL.exe -on "HKEY_CLASSES_ROOT\CLSID\{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}" -ot reg -actn setowner -ownr "n:Administrators"

SetACL.exe -on "HKEY_CLASSES_ROOT\CLSID\{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}" -ot reg -actn ace -ace "n:Administrators;p:full"

SetACL.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{15C20B67-12E7-4BB6-92BB-7AFF07997402}" -ot reg -actn setowner -ownr "n:Administrators"

SetACL.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{15C20B67-12E7-4BB6-92BB-7AFF07997402}" -ot reg -actn ace -ace "n:Administrators;p:full"


STOP: Don't do these last two lines until you confirm the permissions are set - after checking in Component Services and all permissions are correct, you can proceed with the last two script lines below:


SetACL.exe -on "HKEY_CLASSES_ROOT\CLSID\{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}" -ot reg -actn setowner -ownr "n:SYSTEM"

SetACL.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{15C20B67-12E7-4BB6-92BB-7AFF07997402}" -ot reg -actn setowner -ownr "n:NT SERVICE\TrustedInstaller"

Open Component Services and check launch and Activation permissions. If they are still not correct, copy and paste the four middle script lines to take ownership. Refresh the Component Services view and edit launch permissions.

The main ones are SYSTEM, LOCAL SERVICE and NETWORK SERVICE

Once each are given Local Launch and Local Activation Allow permissions, run the last two script lines to set the Trusted Installer as owner and disable built-in administrator.

Reboot and check event log to confirm permissions are working and errors are gone.

 

New 1809 update now shows this in Event Viewer


I haven't gotten those errors but since updating I get 2 of these at a time about every 5 minutes and it just competely fills out my entire event viewer and hard to see anything else.

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
and APPID
{15C20B67-12E7-4BB6-92BB-7AFF07997402}