Event ID 10016, DistributedCOM Windows.SecurityCenter.WscBrokerManager

nyan said:

Hello, swarfega.

I have to agree with borgus regarding this error is new to the latest Windows 10 1803.
Please note we are talking about this particular error Event ID 10016 Windows.SecurityCenter.WscBrokerManager and not event ID 10016 in general with other CLSID/APPID.
I see there was a thread started by EyeInTheSky 3 weeks ago re Windows.SecurityCenter.WscDataProtection
DistributedCOM Error. Solved - Windows 10 Forums

Since I had marked that thread as solved, I have tried a few things since then. Since way back when Windows 10 was first offered as a free upgrade, so long as one was running a valid copy of Windows, I have for the first time reinstalled Windows 10 on a completely wiped hard drive. I'm referring to the hard drive that is listed in "My Computer" specs.


Let me be perfectly clear on this. Ever since Windows 10 was released to the public, I had to never clean install it from scratch ---never. I know, hard to believe right? It is true though. I never had to "Reset, Reinstall, or use any of the Advance Recovery" methods outlined in the "Recovery" section of the settings GUI in Windows 10 for my current SSD.


I forget if I had to use any of the "Advanced Recovery" methods when I was using a HDD in this computer; though that is irrelevant in light of what I'm about to mention.


So, after clean installing Windows 10 (note my version) on my current SSD, this DistributedCOM Error has resurfaced and tells me that even with the latest build of Version 1803, Microsoft has still not addressed the issue. It is the only error I am receiving in the event viewer outside of the occasional ones that happen because a program failed to start or stop properly; but those are usually listed in the Reliability Monitor not the event viewer.

Since I have clean installed Windows 10 for the first time since I have been manually taking care of event viewer errors, I see Microsoft has addressed quite a few, if not all the other ones I had to fix manually, except the one pertaining to Windows.SecurityCenter.WscBrokerManager.


I'm just going to let this one ride out the storm on its own, since others have suggested that it is quite harmless. However; do keep in mind, that if the other ones that were supposedly harmless were fixed by Microsoft, that would indicate to me that they were not merely harmless and needed addressed by Microsoft. From my understanding; manually granting permissions to certain registry keys opened up security issues, and if people fixed them manually and then Microsoft put out a patch, people were running into more problems because they didn't wait for the patch.


My overall take on this, is to let Microsoft deal with this DCOM error in time, if it is indeed a security issue.

This error is not trivial. I just did a clean install created drive shares and updated Windows to release 1803 and I lost access to my shares error 10016 Windows.SecurityCenter.WscBrokerManager.

EyeInTheSky said:

Yes, get rid of the error by going into the Event Viewer and clicking on the event then click on the details tab and then finally the (+) symbol next to System. The GUID will be revealed and just simply copy and paste it into the Registry Search function with the "Keys" checkbox ticked and delete the GUID wherever it appears in the Registry.

My GUID appeared in two locations in the registry and I deleted both without harm being done to Start Up and booting procedures.

Make sure you have a backup of the Registry first, that you get through the Command Prompt in the Recovery environment just in case anything should go wrong.

Mate you are absolute legend for this answer. Worked a treat. Thanks

OEMonsterz said:

Mate you are absolute legend for this answer. Worked a treat. Thanks

You're Welcome!

Glad someone else could confirm that this works. I had tried many different fixes (including ignoring the event viewer log) until I tried eliminating the root cause of an error being generated because certain protocols were flagged that weren't even valid registry entries.

Half the reason event ID errors are generated in the Event Viewer is because it is by design of the OS to flag such errors as a general occurrence that really is of no harm to the operating system. I identified the ones that are of no harm, and have devised a way to eliminate the error being generated under false flags in the CLSID/APPID using the GUID as the trigger point for such errors being generated.

Does any of that BS I just stated make any sense?

Well, I haven't had any errors in my event viewer logs for months now, so I might just be on to something.

Hi,

I have read here and in many other places to suppress event 10016. That is, if you as me, a bad approach.

In this case, with Windows.SecurityCenter it is not as easy to fix as the old classics with the RuntimeBroker, ShellWindows etc which is solved by giving full rights to Administrator in registry and then give SYSTEM, Local Service or whatever launch permissions in DCOM Config. The reason is that you, in this case, don't have any ApplicationId to play around with.

The problem in this case is that the service for Windows SecurityCenter (wscsvc) have a delayed autostart while "things" like the WscBrokerManager and WscCloudBackupProvider tries to initiate very early in the startup process. It will fail with error event 10016. wscsvc will initiate after ~2 minutes and then everything will be instantiated as normal so you will have no side effects of these errors in the event log but it's annoying.

You solve this by changing the service wscsvc from delayed autostart to normal autostart. You don't (normally) have permission to do it from the services app so you must do it in the registry.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc

Change the DWORD DelayedAutoStart from 1 to 0.

Have a nice day!
/Fredrik

I'm noticing a lot of error 10010 and 10016 in my event viewer. I changed autostart to normal in the registry. Afterwards, I'm still getting a ton of these errors after a restart. See the image below.



So I changed the registry back to a delayed autostart.

speedlever said:

I'm noticing a lot of error 10010 and 10016 in my event viewer. I changed autostart to normal in the registry. Afterwards, I'm still getting a ton of these errors after a restart. See the image below.



So I changed the registry back to a delayed autostart.

My particular suggestion was the fix for Windows Security Center. Then if you have other events ID 10016 you have to deal with them in another way. I can't see from your image above what the errors are about. Let me guess: RuntimeBroker, Local Activation?