Windows 10: Event ID: 10016 related to the DCOM app RuntimeBroker

I have been seeing the following even in my laptop's System log for quite some time. (Months.)

The error says essentially: The user CALM1\BobTB, does not have Local Activation permission to the DCom app named RuntimeBroker.

The application-specific permission settings do not grant Local Activation permission for the DCOM Server application with CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160}and APPID {9CA88EE3-ACB7-47C8-AFC4-AB702511C276}to the user CALM1\BobTB SID (S-1-5-21-3317591067-208630158-3867479626-1001) from address LocalHost (Using LRPC) running in the application container Microsoft.MicrosoftEdge_41.16299.15.0_neutral__8wekyb3d8bbwe SID (S-1-15-2-3624051433-2125758914-1423191267-1740899205-1073925389-3782572162-737981194-2385269614-3243675-834220592-3047885450).

The thing is, CALM1\BobTB does have Local Activation permission to the DCOM app named RuntimeBroker.

I'm a bit puzzled as to what to do next.

The laptop itself doesn't seem at all concerned with this event as it continues to run without issue (as far as I can tell).

Maybe I should just ignore it but my preference, is that it not occur at all.
It's the ONLY error event that appears in the System log.

Any ideas would be GREATLY appreciated.

My laptop:
Windows 10 Home version 1709 Build 16299.125.
I run both Malwarebytes premium and Windows defender.
Neither, sfc /scannow or DISM.exe /Online /Cleanup-image /Restorehealth identify any issues.

I have uninstalled and reinstalled the Microsoft Edge browser in hopes it might "fix" the issue but to no avail.
Edge worked perfectly before I uninstalled it and continues to do so after it was reinstalled. (But the event continues to be logged.)

Thanks in advance

:)

 

Event id 10016 runtime broker

This ClassID and AppID are for the RuntimeBroker which is used to manage Windows Store apps; specifically monitoring access to APIs and security checks. So ignoring this isn't necessarily the best thing to do.

I had another DCOM error related to the NVidia video card which was killing applications. That ClassID/AppID combination was used in the example to fix the issue here: Event ID 10016 - DistributedCOM

To fix this specific problem. Follow the same steps with one exception: instead of looking for the AppID in DCOM list, look for the application name (RuntimeBroker) directly, since it is there.

 

Kernel-Power (63) id:41 key words : (70368744177664),(2)

The Event ID 6008 is logged to the System event log when a shutdown operation is initiated automatically by a program. Meanwhile, the
DCOM event ID 10016 is related to certain processes not having permissions to the DCOM components that are mentioned in the event logs.
The specific communications that are blocked are determined to have no adverse functionality other than generating 10016 event logs. We highly recommend that you just ignore these errors because they don't adversely affect functionality. You may
refer to this support article for more information:
DCOM event ID 10016 is logged in Windows.

We hope the information we provided helps.

 

Hey JustRay,
If I remember correctly (I don't use Edge), it has to do with Edge and Clearing Browser Data. I don't remember if it was a specific setting or the Always Clear Browser Data on Exit, but you can turn that off and see if the error goes away. Other than that I don't know of fix and yes, you can safely ignore the error.

 

Use this guide to fix the error. Just insert your keys {******} in place of the ones in this guide and say bye bye to the error.

Stage I. Fixing registry settings

1. Open command prompt elevated and type regedit, then press Enter.

2. In Registry Editor press Ctrl+F, copy class identifier/app identifier from the error message and paste it ({8D8F4F83-3594-4F07-8369-FC3C3CAE4919} / {F72671A9-012C-4725-9D2F-2A4D32D65169}) into the search field; hit Enter to start search.

It is advisable to select Keys to narrow down the search scope to registry keys.

3. When the key is found, it will focus on HKEY_CLASSES_ROOT\CLSID\{8D8F4F83-3594-4F07-8369-FC3C3CAE4919} for ClsID and HKEY_CLASSES_ROOT\AppID\{F72671A9-012C-4725-9D2F-2A4D32D65169}
for AppID.

If you are using 64-bit Windows, there are also copies of the appid key here HKEY_CLASSES_ROOT\Wow6432Node\AppID\{F72671A9-012C-4725-9D2F-2A4D32D65169} (the HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{8D8F4F83-3594-4F07-8369-FC3C3CAE4919} seems to be missing)

But you don't have to change them as the settings propagate from the 64-bit versions of these keys.

You will definitely find the copy here HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8D8F4F83-3594-4F07-8369-FC3C3CAE4919} because HKEY_CLASSES_ROOT is just a junction for HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ and HKEY_CURRENT_USER\SOFTWARE\Classes\

4. Right-click the key and select Permissions.

5. On the Security tab click Advanced.

6. In the Advanced Security Settings dialog click Change next to the Owner and select your account; this is necessary to be able to change permissions. Original owner for class identifier is SYSTEM, for application identifier --- TrustedInstaller account.

7. When you are back in Advanced Security Settings dialog click Add on the Permissions tab and add the SYSTEM account; grant this account Full Control permissions.

8. Click OK to apply permission changes to the specific key.

If you've done this for class identifier key, repeat this procedure for application identifier and vice versa.

Stage II. Adding permissions for the DCOM component

1. Open command prompt elevated and type dcomcnfg.

2. In the Component Services snap-in navigate to Component Services | Computers | My Computer | DCOM Config.

3. Drill down the list of application identifiers in the right-hand pane. Near the bottom of the list you should find the item with the name of {F72671A9-012C-4725-9D2F-2A4D32D65169} and Application id of {F72671A9-012C-4725-9D2F-2A4D32D65169}.

4. Right-click the item and select Properties.

5. Switch to the Security tab and click Edit in the Launch and Activation Permissions group next to the Customize radio button.

6. In the Security tab of the Launch and Activation Permission dialog box click Add and add SYSTEM account to the list. Select Local Launch and Local Activation permissions in the Allow column.

7. Click OK.

Restart the PC. Messages with EventID 10016 should now disappear.

 

Thanks "Eagle51", I'll look into that shortly.

Thank you "EyeInTheSky".
Hmmm.
The "SYSTEM" account is already present and it has both "Local Launch" and "Local Activation" permissions.
Klaatu barada nikto !

 

FYI ... To fix 10016 DCOM errors ... You don't have to do all the registry permission stuff, if you get PowerRun, add the dcomcnfg.exe to its list, then launch the dcomcnfg.exe from PowerRun ... You'll have the permissions you need *Smile

PowerRun - PowerRun v1.1 (Run with highest privileges)

 

I didn't know THAT.
Thanks.

 

Beware of fixing these 'errors' if they don't affect your PC's performance. Only MS understands the issues of fiddling with these permissions and you are risking more problems by trying to fix them. I just leave them until MS decides to fix the 'errors'.