Windows 10: Windows 10 Event ID 10010 and 10016 Errors With DistributedCOM

lx07 - wow!

I wonder how many years I'd need to learn what you know.

Questions: If there's anything "different" in my setup (Win 10 Pro 64-bit) that causes your program to stumble or fail, will your program exit gracefully and/or reverse what it had done before stumbling? If not, do I run risks?

Many thanks.

 

Most of the script is just for giving itself authority to make the change (which I copied from TechNet site).

The script only changes the permissions on 2 registry keys so it will work or not. If you copy the whole script the only reasons I can think of it would fail would be if these keys didn't exist (which would indicate a bigger problem) or if you didn't paste it into an administrator powershell window.

Even if it doesn't work you can always make the same changes manually - it is just easier to run a script than use the GUI (I think anyway).

 

lx07 - Because you are THE MAN, may I ask you the following --

Vaio 7 also wrote:Now open Component Services, Computer, My computer, DCOM config and find ( from the Registry keys above) the Description, it should be Runtime Broker, at least it was for me, if it's other then do it for the exact Component service, right click then Properties then Security tab, then open the Launch and Activation permissions Edit button and depending on the Event Viewer description if it's Local Service or System, click Add, add one of the two and enable the box " Local Activation".
Because my Edit button was greyed out, I never got to see what came next - the text I bolded above. And Vaio 7 takes shortcuts with his descriptions. Do you think his description is correct and doesn't skip something important? Is there anything else?

Thanks again.

 

lx07,

Thank you for the help. It looks like that solved the issue. One question, should I go back into RegEdit and set the permission owner for the keys generating the error back to TrustedInstaller?

EDIT: It looks like the script automatically updates the permission owner back to TrustedInstaller

Rick

 

No need. The script already did it.

If you look in this bit (don't worry you don't need to know powershell just look at the bits in red) you see it changes ownership to Administrators group, grants authority to Administrators group and then changes the owner to TrustedInstaller. Code: # take ownership $key = $reg.OpenSubKey($key, "ReadWriteSubTree", "TakeOwnership") $owner = [Security.Principal.NTAccount]"Administrators" $acl = $key.GetAccessControl() $acl.SetOwner($owner) $key.SetAccessControl($acl) # set FullControl $acl = $key.GetAccessControl() $rule = New-Object System.Security.AccessControl.RegistryAccessRule("Administrators", "FullControl", "Allow") $acl.SetAccessRule($rule) $key.SetAccessControl($acl) # reset owner $owner = [Security.Principal.NTAccount]"NT SERVICE\TrustedInstaller" $acl = $key.GetAccessControl() $acl.SetOwner($owner) $key.SetAccessControl($acl)[/quote]

All should be done.. Now the ownership is correct but members of the Administrators group have permissions to change DCOM permissions for RuntimeBroker. This means you can go into DCOM and add the permissions you want.

Yes their instructions were correct.

Runing the script takes care of all the regedit part (which can be confusing to explain) and then it should no longer be greyed out in DCOM.

Then if your event viewer said "User Local Service had a problem..." or "User System had a problem..." you can add whichever one it reported as an error. I added both (with local launch and activation permissions) as in this picture.





@f14tomcat and @fdegrove posted links to more detailed descriptions earlier in this thread if this isn't clear.

I'd write a script to do the DCOM changes as well as regedit but unfortunately I don't know how yet...


Best of luck *Smile

 

Hello guys
Tried to resolve this on-going error 10016 with Runtime Broker for quite some time now. I tried to do it manually through Registry and I also run this excellent script written by lx07 (run it successfully). Everything is good up to this point (see attached screen shot)




Now I also get this message when I click on 'Access Permissions'. I didn't dare to click 'remove' though. But when I click on 'cancel' everything is grey out so I can't do anything. Any ideas, please?
BTW - great forum!

 

Hi,

Click on "Remove", then continue with this:





then OK, then "Apply", and OK.
Reboot.
Enjoy!*Wink

 

*Ditto It's ok to remove.

 

Thanks Vaio 7 it worked! I had to add 'system' it wasn't showing up but after reboot no more 10016 error. Amazing. Now the only one left is 7031.... but I heard it's up to MS to fix that one. Thanks again to all of you, guys.*Biggrin

 

lx07 and Vaio 7 and Tomcat - It worked! Many thanks !!

Of course, I have another error that's been persistent:
The Sync Host_1cbc4 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.
- System - Provider [ Name] Service Control Manager [ Guid] {555908d1-a6d7-4695-8e1e-26931d2012f4} [ EventSourceName] Service Control Manager - EventID 7031 [ Qualifiers] 49152 Version 0 Level 2 Task 0 Opcode 0 Keywords 0x8080000000000000 - TimeCreated [ SystemTime] 2016-01-08T05:12:54.504758000Z EventRecordID 4830 Correlation - Execution [ ProcessID] 736 [ ThreadID] 368 Channel System Computer DESKTOP-3OLB09N Security
- EventData param1 Sync Host_1cbc4 param2 1 param3 10000 param4 1 param5 Restart the service 4F006E006500530079006E0063005300760063005F00310063006200630034000000
Binary data:

In Words
0000: 006E004F 00530065 006E0079 00530063
0010: 00630076 0031005F 00620063 00340063
0020: 0000

In Bytes
0000: 4F 00 6E 00 65 00 53 00 O.n.e.S.
0008: 79 00 6E 00 63 00 53 00 y.n.c.S.
0010: 76 00 63 00 5F 00 31 00 v.c._.1.
0018: 63 00 62 00 63 00 34 00 c.b.c.4.
0020: 00 00 ..

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />

<EventID Qualifiers="49152">7031</EventID>

<Version>0</Version>

<Level>2</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x8080000000000000</Keywords>

<TimeCreated SystemTime="2016-01-08T05:12:54.504758000Z" />

<EventRecordID>4830</EventRecordID>

<Correlation />

<Execution ProcessID="736" ThreadID="368" />

<Channel>System</Channel>

<Computer>DESKTOP-3OLB09N</Computer>

<Security />

</System>


- <EventData>
<Data Name="param1">Sync Host_1cbc4</Data>

<Data Name="param2">1</Data>

<Data Name="param3">10000</Data>

<Data Name="param4">1</Data>

<Data Name="param5">Restart the service</Data>

<Binary>4F006E006500530079006E0063005300760063005F00310063006200630034000000</Binary>

</EventData>


</Event>

Any ideas?

 

Hi,

That one is actually totally harmless. The error is generated at shutdown/restart. Whenever the system shuts down the service it tries to restart itself but can't and then generates this (I have several similar errors) error in event log.

If it bothers you and you do not need this service to run, you can disable it in the registry by searching for "Sync Host" and change the start up type from 2 (delayed start up) to 4 (disabled)for both registry entries.

You can always change it back should it turn out that it's needed on your system. I think it has to do with synchronizing communications applets such as Mail etc. I don't use any of those and have all of these uninstalled. YMMV.

Either way, this is a "bug" that's been around for a long time now.

Cheers, *Wink

 

fdegrove - noted; thanks.

Out of curiosity, I looked for "Sync Host" in Services, but I can't find it. What Name does it have?

Also, when I'm in Event Viewer and look at an entry, at the bottom of the next page, there is the link "More Information: Event Log Online Help". But when I click on that, I ALWAYS get a technet web page in my browser "Page Not Found". It has NEVER provided any info. Not once. Have you had the same experience?

 

----> In the registry, not services <----

Try changing the URL MS uses for Event Help. Try this:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Event Viewer]
"MicrosoftRedirectionProgram"=hex(2):00,00
"MicrosoftRedirectionProgramCommandLineParameters"=""
"MicrosoftRedirectionURL"="http://www.howtogeek.com/eventid"

Eventviewerhelp_HTG.reg

 

Hi,

No, it should give you a pop up window which contains the event log you are viewing. If you then proceed it should send that info to MS for analysis. Not that I ever heard from them after that but still.........

Cheers, *Wink

 

I get the pop-up for the specific error but then get the unknown TechNet page opening in Edge if I click on send to MS....