Windows 10: Windows 10 Event ID 10010 and 10016 Errors With DistributedCOM

Ugh. Tried fixing the problem as prescribed, and I think I made it worse.

 

The result should look like this (it should say "Done") and you can then go to component services and update your DCOM permissions for RuntimeBroker if you like.

Attachment 57135

Note if you've changed some other keys then you'll have to edit the script or do it manually but the steps are the same - change owner to Administrators, grant authority to Administrators, change ownership back to TrustedInstaller. You can easily do it using the script above by running it and then when it has run change $key to whatever you want and run the Takeown-Registry function Code: $key="HKEY_CLASSES_ROOT\AppID\{<whatever>}" Takeown-Registry($key)[/quote] [/quote] Hay there just had the same problem that everyone else was having. just copied and pasted the script in to the admin powershell window and it worked. However, is their anything that I need to look out for?

 

Is this script really safe to use?

I am getting this error multiple times a day and not sure if its actually causing system problems....

 

Well, I wrote this script and ran it myself before posting it.

My job is a computer programmer (not on windows platform but the concepts are the same) and I think it is safe.

However, I would say that it probably doesn't matter if you get various errors in Event Viewer. I wrote this script so I could understand powershell a bit more and also resolve my slight OCD that I have with these errors.

To be honest, you could run (or not run) the script and your system will work the same either way. You'll get less reported errors in Event Viewer though if that is interesting to you.

Why not make a backup and then try it?

 

Hi,

Lx07's script works fine. I tested it on several occasions so if the DCOM error keeps on popping up then either look at what you're doing wrong or fix the error manually as per Vaio 7's instructions given on the first page.

This is pretty basic stuff and quite straightforward IMHO. No idea why MS has not fixed this yet, probably because it does no real harm so it's not high on their priority list.

That said, as many others here, Lx07 is always very helpful and his postings are outstanding, again IMHO. Well done and keep up the good work.

Cheers, *Wink

 

The result should look like this (it should say "Done") and you can then go to component services and update your DCOM permissions for RuntimeBroker if you like.

What permissions for runtimebroker would you change?

 

Hi,

In dcomcnfg it's the "Launch and Activation" permissions that need to be changed for whatever user the Eventlog is claiming is missing.
If that particular user is not listed you'll need to add it first. Can be yourself, system or whatever inbuilt account Eventviewer is listing.

The basic operation is invariably the same, whether Runtimebroker or Immersiveshell, whatever.

Cheers, *Wink

 

Thanks, that did it! That is an annoying error! Had tried it before, but probably messed up somewhere! Probably will hold till the next Patch Tuesday! *Biggrin

 

Hi,

Exactly... A bit of a PITA but hey, now you know how to fix it, right ?

Best to you all, *Wink

 

Hey all, sorry for posting in an older thread. First time poster here, so I don't know all the forum etiquette *Redface

I have followed all the steps by Vaio 7 and others and got to the step mentioned above by fdegrove.

My event log states: "The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {blahblah} and APPID {blahblah} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable)."

The only users I have listed in Runtime Broker > Security > Launch and Activate Permissions > Edit are: ALL APPLICATION PACKAGES and SELF. Those already have Local Activation permissions.

So should I add user NT AUTHORITY\SYSTEM SID (S-1-5-18) or user NT AUTHORITY\SYSTEM or user SYSTEM? Or is it supposed to be something else like administrators?

 

Hi,

Just click on ADD and in the text box type SYSTEM, click check names.
User SYSTEM will be added to the first screen and you now have to grant this user local permissions (both). Not remote.
Then you need to go back to registry editor and return the initial ownerships for both keys.

Guessing from what you posted I think the first hive key has to be granted to SYSTEM, the second one (App ID) to TrustedInstaller (NT Service\TrustedInstaller). Hard to tell without seeing the actual keys but I assume you have the same DCOM error everyone else has on their systems.

Cheers, *Wink

 

Thank you so much for responding!

I didn't add the keys bc I didn't think they were significant. Here are the full event details:
Code: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160} and APPID {9CA88EE3-ACB7-47C8-AFC4-AB702511C276} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. EventData param1: application-specific param2: Local param3: Activation param4: {D63B10C5-BB46-4990-A94F-E40B9D520160} param5: {9CA88EE3-ACB7-47C8-AFC4-AB702511C276} param6: NT AUTHORITY param7: SYSTEM param8: S-1-5-18 param9: LocalHost (Using LRPC) param10: Unavailable param11: Unavailable[/quote]
I tried my best to follow your instructions. I added user SYSTEM, but I forgot to click "Check Names." I think I just clicked OK. (Should I remove it and add it again?).
Then I checked Allow Local Launch and Allow Local Activation.
Then I went to RegEdit and reverted ownership of CLSID & AppID keys by going to permissions > advanced > change > typing NT SERVICE\TrustedInstaller.
Then I restarted. I hope I did everything right and didn't mess up my registry.

Does this mean I should also add user NT Service\TrustedInstaller to Runtime Broker > Security > Launch and Activate Permission and allow local permissions?

 

Hi,

You're welcome.

I just checked both hive keys and both of them are owned by TrustedInstaller so that's what you need to reset them to.

No need. Just view the "Check Name" thing as an extra measure to make sure you chose the correct name.

You did right. The DCOM error should gone by now.

No, no. The Event Viewer error message tells you what is missing: in your case user ID "SYSTEM" and if that user is missing in DCOM then that's what you add and nothing else.

Sorry for confusing you. *Redface

Cheers, *Wink

 

Seriously, thank you so much for all your help, guidance and explanations. I'm incredibly grateful. It's really nice of you to so many people on this thread. Thanks again and many times more! *Smile

 

Hello, and thank you for all the help and assistance. I am sorry, too, for posting in an older thread, but I am in need of further clarifications before proceeding on to the Component Services steps. Your advise is greatly appreciated.

I have two different occurrences of EVENT ID 10016 on my system. Here are they, as found per Event Viewer

1-



2-



Once translated into English, they should sound something like this

1. Code: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160} and APPID {9CA88EE3-ACB7-47C8-AFC4-AB702511C276} to the user NT AUTHORITY\SID SYSTEM (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.[/quote] 2. Code: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {C2F03A33-21F5-47FA-B4BB-156362A2F239} and APPID {316CDED5-E4AE-4B15-9113-7055D84DCC97} to the user portatile_Asus\SID Marco (S-1-5-21-3351707439-3826623186-4039555236-1002) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.FeatureOnDemand.InsiderHub_10.0.10586.0_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-4016783169-893401051-2237370320-274899566-412088533-2398988950-2155762795). This security permission can be modified using the Component Services administrative tool.[/quote]
And these are, respectively, the corresponding registry keys



1-




-





2-





​ -





Now, once we've temporarily changed owner for registry keys from TrustedInstaller to Administrators, it is proposed that in Component Services we do "open the Launch and Activation permissions Edit button and depending on the Event Viewer description if it's Local Service or System, click Add, add one of the two and enable the box Local Activation."

This last passage is obscure to me. Based on my parameters, as referred above, what exactly should I add in "Launch and Activation permissions"? "Local Service", "System", or something else? I don't know what to do, nor what is meant precisely by "Event Viewer description" in this specific case. Any help is welcomed.

Also, when finally reverting and reassigning registry permissions to TrustedInstaller, am I supposed to remove the allow Full control check mark from Administrators beforehand? Thank you in advance