Windows 10: Re: Event 10016 Warnings CLSID {2593F8B9-4EAF-457C-B68A-50F6B8EA6B54} and APPID...

ReEvent 10016 Warnings CLSID - Microsoft CommunityThe original thread is locked.But, IMO it's important to publicly know that the problem is not benign as described in the thread so IMO the thread should be unlocked and/or a new thread will need to be created like this one and left open.The current problem is that it's likely common on Win11 as it is on mine and related to Blue Screens that have been happening now regularly, maybe weekly compared to maybe monthly or less since this machine was originally a Win10 before upgrading to Win11.IMO the main problem is that the Windows Event Viewer

:)

 

Event 10016 Warnings CLSID {2593F8B9-4EAF-457C-B68A-50F6B8EA6B54} and APPID {15C20B67-12E7-4BB6-92BB-7AFF07997402}

WARNING TO "INDEPENDENT ADVISORS" - if you post on my thread here without answering my question, I will report you to the moderators. Answer my actual question -- without links to your website -- or stay away.

All - On my Win 10 Pro, I recently updated from 1803 to 1903. I continue to get numerous new Event 10016 Warnings about

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID


{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}

and APPID

{15C20B67-12E7-4BB6-92BB-7AFF07997402}

As this is a very common problem, from numerous forums, we all now know that the APPID is for the DCOM item PerAppRuntimeBroker.

I thought I might try to add the "missing" permission settings in dcomcnfg.
HOWEVER, when I hit the Edit button in Launch and Activation Permissions on the Security tab in Properties for PerAppRuntimeBroker, I got this:



That is a new one on me. I hit Cancel.

Also, I searched regedit for the AppID {15c20b67-12e7-4bb6-92bb-7aff07997402}, and I did not see anything that looked like the mentioned nondisplayable permission entries.

What is this Windows Security warning, and what happens to my life if I hit Remove?

Thanks.



☺ In the office, Dell Optiplex 7040 with 8GB RAM, Win 7 Pro 64-bit and Office 2010

☻ At home, Dell Optiplex 7010 with 16GB RAM dual-booting Win 7 Pro 64-bit (now with Office 365 Home) and Win 10 Pro 64-bit

♥ Also still have Dell Optiplex 755 with 4GB RAM with Win XP Pro SP3 (which still gets updates with the POS hack) and Office 2003

 

Warning Event 10016

The computer often freezes for 3-6 seconds and makes a weird noise. Please help!

Event id 10016

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}

and APPID

{15C20B67-12E7-4BB6-92BB-7AFF07997402}

to the user DESKTOP-PSOLOLK\newpa SID (S-1-5-21-1839504509-675473804-2183951259-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services
administrative tool.

 

Event 10016 Warnings CLSID {2593F8B9-4EAF-457C-B68A-50F6B8EA6B54} and APPID {15C20B67-12E7-4BB6-92BB-7AFF07997402}

I can't even believe I'm doing this.

A class identifier - CLSID - identifies a COM object. If the CLSID starts with 2593F8B9, that means the COM object is a runtime broker, which is a commonly used COM object.

I admit to not fully understanding what a runtime broker does, but it relates to apps that you get from Microsoft Store. The runtime broker checks if the apps are declaring all the permissions that they're looking for on your computer.

APPID refers to a process (the kind you see in Task Manager) that can be shared by several CLSIDS. By definition all CLSIDS in an APPID are supposed to have the same security policies, but in reality, the security policy for any CLSID can be set independently.

As I understand it, before running a COM object, Windows checks to see whether its security policies match the security policies of the APPID. But we already know that it's normal for COM objects to set their own security policies, so it's no big deal
if Windows discovers that the security policies differ from the security policies of the APPID.

No big deal, but Event Viewer is a log, so it records everything whether it matters or not.

And that's as far as I'm going with this. If anyone who understands this technology better than me wants to step in and correct me or add additional details I will be most grateful.