Windows 10: Event ID 10016 - The application-specific permission settings - user is not recognized-...

System reports Event ID 10016 a lot!

System Log file states -


The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{D63B10C5-BB46-4990-A94F-E40B9D520160}

and APPID

{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}

to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.


Stated fixes suggest user changes permissions on class and Appid's but the permissions cannot be changed!


ClassID {9CA88EE3-ACB7-47c8-AFC4-AB702511C276} has value "C:\Windows\System32\RuntimeBroker.exe", there are at least two of these listed in DCOMServices one with AppID {15c20b67-12e7-4bb6-92bb-7aff07997402} and the other with AppID {9CA88EE3-ACB7-47c8-AFC4-AB702511C276}


Security Launch and Activation permissions under runtimebroker properties window are unsettable (Greyed out) as is access permissions and Configuration permissions. So they cannot be reset.

Switching to Elevated Admin user also does not elevate privileges to level where these can be changed! !!

Identity cannot be changed...even if DCOM Configuration is run at elevated level under component services DCOM Config...


Choosing to edit the Launch and activation permissions produces the error

Windows Security

"One or more of the permission entries attached to registry value has an unrecognized type and can not be displayed."


Only choice is OK.


Question: Why is the user listed as "...user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19)..." above when there is no such user at greater than admin level, or even elevated admin level? How can there be an Admin level user with higher privileges than ADMIN?


Why is this user level seen elsewhere in the DCOM config properties and how come this has not been checked? Did someone at Microsoft release a new higher level user to the world in an update?


What knock on security impacts and effects could there be from this ?

I was working on some military proposal stuff (which was mentioned to dispatches) when this came to light guys so please don't be sweeping it under the carpet!!

:)

 

Event ID 10016 - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

After my Windows 10 upgrade i see this well-known DCOM Event-ID 10016 in the event viewer:

"The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{D63B10C5-BB46-4990-A94F-E40B9D520160}

and APPID

{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}

to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool."

It is from the Runtimebroker.exe - i know this error was in Windows 8.1 and below, too in the past ->

http://answers.microsoft.com/en-us/...n/9ff8796f-c352-4da2-9322-5fdf8a11c81e?page=1

But the solutions from there, which worked till Win 8.1, don't work now under Windows 10.

Has anybody a solution for this under Windows 10? I'm not sure if this error has an effect or causes bugs, but the Event Log gets very big because of the many 10016 IDs every time.

Thx in advance for any info or solution in that case.

 

Persistent EVENT ID 10016


Hello, every hour I get this error:

I've followed this guide: http://www.itexperience.net/2017/01/...on-with-clsid/ but didn't fixed the issue.I've the latest Windows build. Do you have any suggestion?

 

event id 10016

Hi Steven,

Go through this
forum post and follow the troubleshooting steps listed.

Let us know how it goes.

Regards.