Windows 10: What Event IDs are Enabled by Default?

I'm trying to figure out what Event IDs are enabled by default for Windows 10 and Windows 11 devices. Is there a list of these or is it possible to query them in PowerShell on a brand new image?Thank you.

:)

 

how to enable specific event id in security.evtx

How to enable an Event ID which is not enabled by default in Security.evtx

 

Event ID 10016

Solved Numerous event id 10016 errors win 8 pro 64 bit

Here is the basic outline ...

1. Search the registry for the CLSID
2. Make note of the Default Value, which is the name (ex. ShellExperienceHost, RuntimeBroker) you're going to look for in DCOM
3. Change the Owner to Administrators
4. Give Administrators Full Control
5. Repeat steps 1-4 for the APPID
6. WinKey + s > type in component services > click on Component Services in list
7. Component Services > Computers > My Computer > DCOM Config
8. Change the View to Details
9. Find the name from step 2 (ex. ShellExperienceHost, RuntimeBroker)
10. Right Click on the Name > Properties
11. Select the Security Tab
12. Launch & Activation Permissions > Click Edit
13. Look for the offending user from the 10016 (ex. System, Local Service) and make sure it has the activation requested (ex. Local Activation). If the offending user does NOT exist, you have to add it and give it Local Launch and Local Activation
14. Click Apply
15. Close DCOM and Regedit
16. Reboot PC

Note: Make sure you understand the steps before doing them

 

Event ID 10016, CLSID and APPID

Hey, I've been trying to resolve this same dcom issue myself, and I followed the steps you listed @FreeBooter, but when I try to do the last step, I firstly when clicking "edit" get a message saying



And then when I do enter the menu after clicking "ok" on that dialog box, the add button is greyed out.

I'm 100% certain I followed all the steps correctly. I triple-checked it. But no dice...