Windows 10: Why Certain DCOM 10016 Events Don't Matter

Here at TenForums.com we get lots of questions about Event ID 10016, which shows up in Event Viewer on nearly all Windows 10 PCs (and in modern Server versions as well, as it turns out). People who post these questions may even be irritated or upset. Usually, they want to make those events go away, and absent themselves from the Event log.

Thanks to some excellent sleuthing work from long-time member @f14tomcat, I can cite a Microsoft Support Note to explain that these events are perfectly normal. In fact, they do not need to be fixed, removed, or otherwise mitigated. The title of the note is "DCOM event ID 10016 is logged in Windows." As I write this post, the note reports it was last updated on April 30, 2018. It also reports that it applies to the following Windows versions:

How can I assert that certain DCOM 10016 events don't matter? Because the note makes it clear that any such events that mention "application-specific settings do not grant Local Activation permission" are normal for the afore-cited Windows versions. Here's the meaty part of the Support Note that explains things completely:

What if I MUST Silence These Events Anyway?
Some Windows 10 users won't like or care about this explanation. They simply won't settle for anything less than a clean Event Viewer on their PCs.

For such folks, the note provides instructions on how to suppress those events in the Event Viewer "by creating a filter and manually editing the filter's XML query." Please consult the Note for detailed instructions.

For the rest of us -- including me -- we can safely and completely ignore those events. They do not indicate problems or trouble, and occur by deliberate design.

HTH,
--Ed--




:)

 

Event id 10016 runtime broker

This ClassID and AppID are for the RuntimeBroker which is used to manage Windows Store apps; specifically monitoring access to APIs and security checks. So ignoring this isn't necessarily the best thing to do.

I had another DCOM error related to the NVidia video card which was killing applications. That ClassID/AppID combination was used in the example to fix the issue here: Event ID 10016 - DistributedCOM

To fix this specific problem. Follow the same steps with one exception: instead of looking for the AppID in DCOM list, look for the application name (RuntimeBroker) directly, since it is there.

 

Beyond sick of this issue - Event ID 10016 application issue.

Hi Marcus,

The event logs are recorded because certain processes don't have permissions to the DCOM components. The specific communications that are blocked are determined to have no adverse functionality other than generating 10016 event logs so you may ignore it.
You may also change the permission on DCOM components to prevent this error from being logged. However, this may have side effects.

To prevent the events from being logged, follow these steps to grant permission to the DCOM components that have specific CLSIDs and APPIDs.

Note You can find the CLSID and APPID in the event log entry.

• Start Registry Editor (regedit).
• Locate the following registry subkey:
  
  HKEY_CLASSES_ROOT\CLSID\<Target AppID>
• Right-click the subkey, and then click Permissions.
• Click Advanced.
• Click Add.
• Click Select a principal.
• In the Select User or Group dialog box, enter the appropriate administrators group in the
  Enter the object name to select box. For example, enter <ComputerName>\Administrators.
• Click OK.
• On the Security tab, grant Full Control, and then click
  OK.
• Exit Registry Editor.
• Start DCOM Config (dcomcnfg).
• Expand Component Services > Computers > My Computer > DCOM Config.
• Right-click the application that corresponds to the AppID that's recorded in the event log, and then select
  Properties.
• Select the Security tab.
• In the Launch and Activation Permissions area, select the Customize option, and then select
  Edit.
• Under Group or user names, select Add.
• Enter the group or user name that's recorded in the event log.
• Click OK.

For more information regarding Event ID 10016, you may check out
DCOM event ID 10016 is logged in Windows.

Please update this thread with the result.

Regards.