Windows 10: Windows 10 Event ID 10010 and 10016 Errors With DistributedCOM

Hi,

Most hive keys are owned by Trusted Installer but not all them.

 

Thank you for the very insightful and kind reply. Now I think I do understand the procedure a lot better. Maybe I am a tad too concerned, but I would not like to break anything important, and end up with an unstable system.

Thus, let me rely on your guidance and deep knowledge once more, granted and hoping you have the time and patience to help me out. It is truly appreciated.

Can you please verify that the following passages, specific to my case, are in fact accurate? Thanks for all of the precious advise you provide, to myself and others.



A. First DistributedCOM error with Event ID 10016







Code: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160} and APPID {9CA88EE3-ACB7-47C8-AFC4-AB702511C276} to the user NT AUTHORITY\SID SYSTEM (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.[/quote]










CLSID: {D63B10C5-BB46-4990-A94F-E40B9D520160}

APPID: {9CA88EE3-ACB7-47C8-AFC4-AB702511C276}

User: SYSTEM or NT AUTHORITY\SID SYSTEM (S-1-5-18)

Application: RuntimeBroker



1- Open Regedit with Administrative rights

2- Navigate to HKEY_CLASSES_ROOT > CLSID > {D63B10C5-BB46-4990-A94F-E40B9D520160}

3- Right-click on it and select "Permissions..." option

4- In the new dialog box

(image from my machine) click on "Advanced" button

5- At the top, look for "Owner" and click on "Change" button near "TrustedInstaller"

6- In the new dialog box type "Administrators" and click on "Check Names" button (it supposedly converts the name to correct format)

7- Click on "OK" button

8- Select "Administrators" in the first dialog box and check the "Allow" checkbox given for "Full Control" option

9- Click on "Apply" and "OK" buttons

10- Navigate to HKEY_CLASSES_ROOT > APPID > {9CA88EE3-ACB7-47C8-AFC4-AB702511C276}

11- Repeat passages #3-#9

12- Close Regedit

13- Open Component Services with Administrative rights

14- Browse to Console Root > Component Services > Computers > My Computer > DCOM Config

15- Find "RuntimeBroker" from the icon list, right click on it and select "Properties"

16- Navigate to the "Security" tab and click the "Edit" button in the "Launch and Activation Permissions" section

17- In the newly opened dialogue box (Launch and Activation Permission), If "SYSTEM" is missing from the "Group or user names" list section proceed to #18, otherwise skip to #21

18- Click the "Add" button

19- Type in "SYSTEM", that is the User as found per Event ID 10016 from Event Viewer, and click on "Check Names" button (it supposedly converts the name to correct format)

20- Click the "OK" button. You're back in "Launch and Activation Permission" dialogue box

21- Select "SYSTEM" from the "Group or user names" list, and click to place a check in the "Local Activation"/"Allow" box

22- Click the "OK" button

23- Back in the "Security" tab, click the "Apply" button, then keep clicking "OK" until all windows are closed

24- Open Regedit with Administrative rights

25- Reassign ownership back to default "TrustedInstaller" for the two modified CLSID and APPID values

26- In order to do so, type "NT SERVICE\TrustedInstaller" (without quotes) in the dialogue box mentioned at #6, and click the "OK" button

27- Close all windows and exit Regedit

28- Reboot



B. Second DistributedCOM error with Event ID 10016







Code: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {C2F03A33-21F5-47FA-B4BB-156362A2F239} and APPID {316CDED5-E4AE-4B15-9113-7055D84DCC97} to the user portatile_Asus\SID Marco (S-1-5-21-3351707439-3826623186-4039555236-1002) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.FeatureOnDemand.InsiderHub_10.0.10586.0_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-4016783169-893401051-2237370320-274899566-412088533-2398988950-2155762795). This security permission can be modified using the Component Services administrative tool.[/quote]










CLSID: {C2F03A33-21F5-47FA-B4BB-156362A2F239}

APPID: {316CDED5-E4AE-4B15-9113-7055D84DCC97}

User: portatile_Asus\Marco or portatile_Asus\SID Marco (S-1-5-21-3351707439-3826623186-4039555236-1002)

Application: Immersive Shell



1- Open Regedit with Administrative rights

2- Navigate to HKEY_CLASSES_ROOT > CLSID > {C2F03A33-21F5-47FA-B4BB-156362A2F239}

3- Right-click on it and select "Permissions..." option

4- In the new dialog box

(image from my machine) click on "Advanced" button

5- At the top, look for "Owner" and click on "Change" button near "TrustedInstaller"

6- In the new dialog box type "Administrators" and click on "Check Names" button (it supposedly converts the name to correct format)

7- Click on "OK" button

8- Select "Administrators" in the first dialog box and check the "Allow" checkbox given for "Full Control" option

9- Click on "Apply" and "OK" buttons

10- Navigate to HKEY_CLASSES_ROOT > APPID > {316CDED5-E4AE-4B15-9113-7055D84DCC97}

11- Repeat passages #3-#9

12- Close Regedit

13- Open Component Services with Administrative rights

14- Browse to Console Root > Component Services > Computers > My Computer > DCOM Config

15- Find "Immersive Shell" from the icon list, right click on it and select "Properties"

16- Navigate to the "Security" tab and click the "Edit" button in the "Launch and Activation Permissions" section

17- In the newly opened dialogue box (Launch and Activation Permission), If "portatile_Asus\Marco" is missing from the "Group or user names" list section proceed to #18, otherwise skip to #21

18- Click the "Add" button

19- Type in "portatile_Asus\Marco", that is the User as found per Event ID 10016 from Event Viewer, and click on "Check Names" button (it supposedly converts the name to correct format)

20- Click the "OK" button. You're back in "Launch and Activation Permission" dialogue box

21- Select "portatile_Asus\Marco" from the "Group or user names" list, and click to place a check in the "Local Activation"/"Allow" box

22- Click the "OK" button

23- Back in the "Security" tab, click the "Apply" button, then keep clicking "OK" until all windows are closed

24- Open Regedit with Administrative rights

25- Reassign ownership back to default "TrustedInstaller" for the two modified CLSID and APPID values

26- In order to do so, type "NT SERVICE\TrustedInstaller" (without quotes) in the dialogue box mentioned at #6, and click the "OK" button

27- Close all windows and exit Regedit

28- Reboot



Could you please check and tell me if both procedures, as exposed above through multiple paragraphs, are correct and safe to perform? As you can see, I've tried to include my own parameters. Is everything truly and completely accurate? Thank you

 

Hi,

Looks good to me.
Only a few things I want to add for your convenience: no need to close the registry editor whilst your are in DCOM console.
A reboot is not required immediately. At next restart the error(s) should no longer appear.

DCOM errors are pretty harmless to begin with. Don't be surprised that they or some of them keep coming back with every update MS releases for as long as MS don't fix these (and they can't seem to be bothered at this point in time) all the configuring we did now will be overwritten.

You did a great job Marco. This way it should be easier to understand for others as well.

Cheers, *Wink

 

Thank you fdegrove. So I tried it, and in the first instance, that is RuntimeBroker, method worked just fine, no more DistributedCOM errors. Whereas in the second instance, that is Immersive Shell, it did not work. I'm sure I did everything exactly as described above in my previous post, but the DistributedCOM error keeps coming back as before. Any ideas or suggestions?

 

New one with redstone upgrade: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {8D8F4F83-3594-4F07-8369-FC3C3CAE4919} and APPID {F72671A9-012C-4725-9D2F-2A4D32D65169} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Has to do with CDP Activity Store, whatever that is.

 

Hi,

No suggestions really. The procedure is basically always the same.
Maybe do it once more and check everything thoroughly ?
@csmdew : the first hive key is granted to System not TrustedInstaller. The second key is also the DCOM container.
You will have to add System as a user because it's missing in DCOM.


Cheers, *Wink

 

OK I already had system added but who should be the owner so I can edit the security, it's still grayed out with system as owner. How can I edit the batch file used for runtime broker to fix this one, thanks.

 

Hi,

In regedit ownership should temporarily be granted to Administrators (plural) for both keys then returned to the original owners after you're done in dcomcnfg.

In your particular case original ownership of the first key belongs to SYSTEM so you have to keep that in mind.

Cheers, *Wink

 

made changes and after this reboot the 10016 was gone but now the 10010 is back, you would think with all the problems in this area that MS would have fixed it in the upgrade. thanks for the 10016 help now back to solving the other one.

 

Thanks Fdegrove. So, I was reading this thread on EightForums Solved Numerous event id 10016 errors win 8 pro 64 bit when I remembered that, right after assigning ownership from TrustedInstaller to Administrators, there were these other two options, which are supposed to give you permission on all sub-keys:

- Replace owner on subcontainers and objects

- Replace all child object permission entries with inheritable permission entries from this object





Do you think I need to select said options maybe? Will it make a difference with my "Immersive Shell" issue?



As a side note, on Microsoft Answers forum one user suggested an alternative way as to take ownership and allow permissions without modifying the registry. That is, by launching Component Services as administrator, then navigating to My Computer node > Right click > Properties > COM Security tab > Edit Limits.







But I cannot tell if this is reliable as a method. Do you think it is safe to try it as a last resort for "Immersive Shell" DistributedCOM error? Needless to say, I'm quite reluctant and hesitant

 

Hi,

I don't think so but you can try it out. Basically when you're able to add the user in DCOM and grant the local permissions to that and then return the registry keys to the original owner then that's it.

The so called second method allows you to add a user but then that user would be added to all the containers ?
I don't see the point in doing that.

The Immersive shell DCOM error has been there for a long time but I can't remember it being present with the Anniversary Upgrade.
Either way, if you follow the basic guidelines and you're able to grant the local permissions for the user in the Event Viewer error message then that's all there's to it.

One thing I can think of why it doesn't stick is when fast boot is enabled. You could try disabling it, see if that helps and re-enable it once the problem is gone.

Cheers, *Wink

 

Hey all, and thanks again for help many months ago.
With the Anniversary Update, I am now getting the following, and have a new sub-question:

My sub-question is: why does it say "running in the application container Unavailable SID (Unavailable)"? Should I do anything special because it's "Unavailable SID (Unavailable)"?

Thanks.