Event ID 10016, DistributedCOM Windows.SecurityCenter.WscBrokerManager

Fredrik said:

My particular suggestion was the fix for Windows Security Center. Then if you have other events ID 10016 you have to deal with them in another way. I can't see from your image above what the errors are about. Let me guess: RuntimeBroker, Local Activation?

I don't think it's RuntimeBroker. Take a look at a recent one:

speedlever said:

I don't think it's RuntimeBroker. Take a look at a recent one:

That APPID is "Windows Management and Instrumentation" (WMI). I guess you could try to grant Local Activation on WMI in dcomcnfg for SID (S-1-15-2-350187224-..... the whole SID) or if that doesn't work grant Local Activation for 'ALL APPLICATION PACKAGES'.

You know already, I guess, that you first must give Administrators full access to both APPID and CLSID in registry?

Then again - granting activation access for ALL APPLICATION PACKAGES...? I am not sure it's wise or not but it would get rid of your error. The ContentDeliveryManager is the process that updates the content of your APPS. I can't answer why it think it needs access to WMI.

thanks. perhaps i'll just leave it alone.

Fredrik said:

Hi,
You solve this by changing the service wscsvc from delayed autostart to normal autostart. You don't (normally) have permission to do it from the services app so you must do it in the registry.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc
Change the DWORD DelayedAutoStart from 1 to 0.
/Fredrik

Thanks Fredrik; i don't know how you found / invented this solution (trying out?), but it works indeed. Fantastic!!

Fredrik said:

Hi,

I have read here and in many other places to suppress event 10016. That is, if you as me, a bad approach.

In this case, with Windows.SecurityCenter it is not as easy to fix as the old classics with the RuntimeBroker, ShellWindows etc which is solved by giving full rights to Administrator in registry and then give SYSTEM, Local Service or whatever launch permissions in DCOM Config. The reason is that you, in this case, don't have any ApplicationId to play around with.

The problem in this case is that the service for Windows SecurityCenter (wscsvc) have a delayed autostart while "things" like the WscBrokerManager and WscCloudBackupProvider tries to initiate very early in the startup process. It will fail with error event 10016. wscsvc will initiate after ~2 minutes and then everything will be instantiated as normal so you will have no side effects of these errors in the event log but it's annoying.

You solve this by changing the service wscsvc from delayed autostart to normal autostart. You don't (normally) have permission to do it from the services app so you must do it in the registry.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc

Change the DWORD DelayedAutoStart from 1 to 0.

Have a nice day!
/Fredrik

This actually solved my dcom errors realted to windows security center...thanks

Fredrik said:

Hi,
You solve this by changing the service wscsvc from delayed autostart to normal autostart. You don't (normally) have permission to do it from the services app so you must do it in the registry.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc
Change the DWORD DelayedAutoStart from 1 to 0.
/Fredrik

This has just worked in my 1903, which I've had since yesterday evening. Nice job, Frederik!

Wait a second.

Is it possible that the fix here has caused a different problem? In Event Viewer, I am now getting LOTS of Event 10016 System Warnings as follows:

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
and APPID
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
to the user DESKTOP-3#####N\[My User Name] SID (S-1-5-21-[9, 10 and 9 digits]-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

For now, I am NOT fixing these Event 10016 warnings the normal way by changing stuff in DCOM -- see Why Certain DCOM 10016 Events Don't Matter and read to the end.

But has Frederik's fix here caused this problem?

Thanks.

glnz said:

Wait a second.

Is it possible that the fix here has caused a different problem? In Event Viewer, I am now getting LOTS of Event 10016 System Warnings as follows:


For now, I am NOT fixing these Event 10016 warnings the normal way by changing stuff in DCOM -- see Why Certain DCOM 10016 Events Don't Matter and read to the end.

But has Frederik's fix here caused this problem?

Thanks.

No, my tips above have nothing to do with 15C20B67-12E7-4BB6-92BB-7AFF07997402 which is PerAppTimeBroker in Win1903 (RuntimeBroker in Win1809). To get rid of that error you need to add Local Activation Permissions for 'User' to PerAppTimeBroker. Yes 'User' since Google Chrome and some Adobe products execute in User sandbox mode.

You can do whatever you want but it's is NOT deliberate design as mentioned in your linked post.

Fredrik,

I hereby anoint you Sir Fredrik for this excellent solution (@ #16) . Worked at treat and got rid of my 3 DCOM 10016 errors:

windows.securitycenter.wscbrokermanager

windows.securitycenter.wscdataprotection

windows.securitycenter.securityappbroker