Windows 10: Event 3104 Errors Since Anniversary Upgrade

I've started getting Event 3104 errors since the Anniversary Upgrade (see below). I reset the search index but the error continues. Does anyone have this issue and have you found a solution?



Error 05/08/2016 21:40:09
Microsoft-Windows-Search 3104 Gatherer "Enumerating user sessions to generate filter pools failed."

Details:
(HRESULT : 0x80040210) (0x80040210)

:)

 

Event 3104 Search: "Enumerating user sessions to generate filter pools failed"

I have done this and I still get the error. It's random, but still occurs.

 

Event 3104 Search: "Enumerating user sessions to generate filter pools failed"

Total radio silence from Microsoft. Still no new reaction in here from any MS technician/supporter since Srimadhwa B replied on August 9!!

Probable Fix?

Reading other forums threads about same issue I see this “Probable fix: The fix for me on this was to add the SYSTEM account to the DCOM Security”. You find its details here:
Probable fix?

I would like to hear if anyone in here knows of this and might have any comments on it?

Notice: this is in fact NOT a reply a reply to ben channell's post above on August 18, 2016, sorry ben.

 

I've got the same issue on two machines running 1607.

 

Hi
I've got the same issue running with clean install pro version 14393.10.
The strange thing I found is that the users I have 3 folders <My account> <default (hidden)> <defaultuser0>
it's normal?
While in the updated version is not present <defaultuser0>.

Error in clean install:
evnt error: Search id 3104 Gatherer
Could not enumerate the user sessions for the generation of the filter pooh.
Details: (HRESULT: 0x80040210) (0x80040210)
and
DistributedCOM id 10016
Settings specific permissions settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
e APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
to the user NT AUTHORITY \ SYSTEM SID (S-1-5-18) address LocalHost (via LRPCs) running in the CIS of the applications container Not Available (Not Available). To change the security clearance, you can use the Component Services administrative tool.

Error in the updated version:
Event ID 4401
Source: EFS
Message: 7,488: The EFS service could not run the provisioning of a user for enterprise data protection.
Error code: 0x80070005. (I have no one game or app. on another drive that is referenced by the C)
and:
DistributedCOM id 10016
Settings specific permissions settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
e APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
to the user NT AUTHORITY \ SYSTEM SID (S-1-5-18) address LocalHost (via LRPCs) running in the CIS of the applications container Not Available (Not Available). To change the security clearance, you can use the Component Services administrative tool.

Thank you

 

I have the same users as before the upgrade and can't see anything wrong there. My 3104 errors come in bursts - I had 20 this morning all logged at the same time.

 

Just to add that I noticed this same burst of errors this morning after turning on my PC. It seemed to be triggered by the fact that my system had not shutdown properly and the fast startup failed. I will investigate further, this is the first time I have seen it and my previous shutdowns had been fine.

 

I had another burst of 20 error messages this morning about one hour after turning on my PC so the errors are not correlated with my PC start up.

 

I just changed indexing options to index D drive and immediately got this error for the first time (3 times in the same second actually). I'd not had it before but then I only clean installed yesterday. Indexing completed normally though (or at least it says it did).

 

I also have error after upgrading to the Windows 10 Anniversary update:

Microsoft-Windows-Search 3104 Gatherer "Enumerating user sessions to generate filter pools failed."

Details:
(HRESULT : 0x80040210) (0x80040210)

I have upgrade both my desktop PC and my laptop and both now get this error.

 

I get this problem as well

 

This seems to be a consistent error reported since my first post. Let's see how long it takes for MS to fix the issue (if ever).

 

The fix for me on this was to add the SYSTEM account to the DCOM Security. Go to Component Services, computers, my computer, right click and properties , go to COM security, in access permissions AND Launch Activation Permissions Edit the limits and edit the Defaults and ensure the SYSTEM account is added and given all rights locally and remote.

All my errors like this went away afterwards. Now I just have the WUDFRd event ID 219 left on Anniversary edition.

 

Pchesels: nice solution! worked for me, too. Thanks for sharing.
--Ed--

 

I haven't had this error for over a week so maybe MS fixed the problem? My main errors are now the common 10016 errors.