Windows 10: Event ID 10016, DistributedCOM Windows.SecurityCenter.WscBrokerManager

Sounds like we might all learn something from your further investigations. Do keep us posted, please. Best of luck in running this to ground.
--Ed--

 

Greetings.

Updated to 1803 17134.1 without a problem but one error - Distributed COM event ID 10016.
Experienced this event ID many times previously and have fixed by changing permissions in Registry but this one has no known CLSID/APPID.

"The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
Windows.SecurityCenter.WscBrokerManager
and APPID
Unavailable
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool."

Code: - System - Provider [ Name] Microsoft-Windows-DistributedCOM [ Guid] {1B562E86-B7AA-4131-BADC-B6F3A001407E} [ EventSourceName] DCOM - EventID 10016 [ Qualifiers] 0 Version 0 Level 2 Task 0 Opcode 0 Keywords 0x8080000000000000 - TimeCreated [ SystemTime] 2018-05-01T13:13:11.470871100Z EventRecordID 1072 Correlation - Execution [ ProcessID] 512 [ ThreadID] 1876 Channel System Computer - Security [ UserID] S-1-5-18 - EventData param1 application-specific param2 Local param3 Launch param4 Windows.SecurityCenter.WscBrokerManager param5 Unavailable param6 NT AUTHORITY param7 SYSTEM param8 S-1-5-18 param9 LocalHost (Using LRPC) param10 Unavailable param11 Unavailable [/quote]
I am guessing this is nothing serious but I just can not stand an error showing in Event Viewer.
Your advises much appreciated.

*Smile

:)

 

Since the Fall Creators Update, my computer freezes every other day, even after a clean Windows (10) reset

Try to fix 10016 like this

Error - Event ID: 10016; DistributedCOM

 

Event log writes error related to application-specific permissions on Windows 10 computer

Event ID 10016 - DistributedCOM

 

Search for the GUID in regedit.exe instead. You may learn something interesting. That's about all you have to go on, really.
HTH,
--Ed--

 

Yes, get rid of the error by going into the Event Viewer and clicking on the event then click on the details tab and then finally the (+) symbol next to System. The GUID will be revealed and just simply copy and paste it into the Registry Search function with the "Keys" checkbox ticked and delete the GUID wherever it appears in the Registry.

My GUID appeared in two locations in the registry and I deleted both without harm being done to Start Up and booting procedures.

Make sure you have a backup of the Registry first, that you get through the Command Prompt in the Recovery environment just in case anything should go wrong.

 

Thank you for your suggestions EdTittel and EyeInTheSky, and also Brink for the code box stuff.

Since then I disabled the log so to ignore it for now.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{1b562e86-b7aa-4131-badc-b6f3a001407e} changed the Enabled value data to 0.

I still don't know what it is so I'll continue looking for explanation and solution.

Regards,

*Smile