DISTRIBUTEDCOM Event error 10016

I understand your frustration. I recently just fixed some 10016 errors only to have them return. Microsoft is starting to get on my last circuit of sanity because it seems like it is some game to them to slow down our computers with these errors.

This article is what I have been following lately.

https://answers.microsoft.com/en-us/...abbe349?page=2

Clyde Wynter's response in that article is what I completely agree with. These errors are having an effect on CPU usage, booting times/problems, system freezes and printing problems regardless of Microsoft claiming otherwise. As far as I'm concerned, Microsoft is trying to gain further control of our systems and claiming these errors are harmless when the proof is there proving them wrong.

I swear Microsoft is doing this crap on purpose and every month I have to find a new article to follow to stop the 10016 errors and furthermore, the usual tactics of fixing these errors are obsolete.

These are the affected DCOM components and keys we find on many systems after updates:

1/ RunTimeBroker - 1st entry

"HKEY_CLASSES_ROOT\CLSID\{2593f8b9-4eaf-457c-b68a-50f6b8ea6b54}"

"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{15c20b67-12e7-4bb6-92bb-7aff07997402}"

2/ RunTimeBroker - 2nd entry

"HKEY_CLASSES_ROOT\CLSID\{D63B10C5-BB46-4990-A94F-E40B9D520160}"

"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}"

3/ ShellServiceHost

"HKEY_CLASSES_ROOT\CLSID\{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}"

"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}"

4/ Windows Management and Instrumentation

"HKEY_CLASSES_ROOT\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}"

5/ Immersive Shell

"HKEY_CLASSES_ROOT\CLSID\{C2F03A33-21F5-47FA-B4BB-156362A2F239}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{316CDED5-E4AE-4B15-9113-7055D84DCC97}"



To fix these issues:

Download SetACL.exe from SetACL - Automate Permissions and Manage ACLs • Helge Klein

Or: See attachment at end of post.

Copy to c:\windows\system32 and make sure you use the appropriate 32 or 64 bit file for your architecture.

Enable the built-in Administrator account, follow these steps:

Open Command Prompt (Admin).

In the elevated Command Prompt, type the following command and then press Enter.

Net user administrator /active:yes


To disable the built-in Administrator account, simply type Net user administrator /active:no in the elevated Command Prompt; but only do this after you have run all your script lines below.

Create text file scripts in this format: (Change CLSID and APPID for each DCOM). In other words, plug your CLSID and AppID alphanumeric lines from your Event Viewer error (10016) between { } in each line below and hit enter after each line is entered in the cmd prompt.

The current CLSID and AppID in the lines below are one of the common DCOM components that need addressed and you can just enter your CLSID or AppID's instead.

Make sure you pay attention to \CLSID\ and \AppID\ in each line below so you plug your alphanumeric codes in right.

Do each script line one at a time, hitting "Enter" after each line:


reg query "HKEY_CLASSES_ROOT\CLSID\{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}" /ve

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{15C20B67-12E7-4BB6-92BB-7AFF07997402}" /ve


SetACL.exe -on "HKEY_CLASSES_ROOT\CLSID\{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}" -ot reg -actn setowner -ownr "n:Administrators"

SetACL.exe -on "HKEY_CLASSES_ROOT\CLSID\{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}" -ot reg -actn ace -ace "n:Administrators;p:full"

SetACL.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{15C20B67-12E7-4BB6-92BB-7AFF07997402}" -ot reg -actn setowner -ownr "n:Administrators"

SetACL.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{15C20B67-12E7-4BB6-92BB-7AFF07997402}" -ot reg -actn ace -ace "n:Administrators;p:full"


STOP: Don't do these last two lines until you confirm the permissions are set - after checking in Component Services and all permissions are correct, you can proceed with the last two script lines below:


SetACL.exe -on "HKEY_CLASSES_ROOT\CLSID\{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}" -ot reg -actn setowner -ownr "n:SYSTEM"

SetACL.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{15C20B67-12E7-4BB6-92BB-7AFF07997402}" -ot reg -actn setowner -ownr "n:NT SERVICE\TrustedInstaller"

Open Component Services and check launch and Activation permissions. If they are still not correct, copy and paste the four middle script lines to take ownership. Refresh the Component Services view and edit launch permissions.

The main ones are SYSTEM, LOCAL SERVICE and NETWORK SERVICE

Once each are given Local Launch and Local Activation Allow permissions, run the last two script lines to set the Trusted Installer as owner and disable built-in administrator.

Reboot and check event log to confirm permissions are working and errors are gone.

As you mentioned it.

I rechecked my event viewer, and yes the error has returned.

But it seems not to be effecting Start-Up, just showing errors.

" The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160} and APPID {9CA88EE3-ACB7-47C8-AFC4-AB702511C276} to the user: **********"

Which checking with Regedit it is RunTime Broker.
While in regedit, the permissions were not 'full control'.

Having selected full control and restarted the laptop.
Checking event viewer, seems to cleared the error.

tensone said:

As you mentioned it.

I rechecked my event viewer, and yes the error has returned.

Correct, and my post #13 use to be the sure-fire way of getting rid of the errors outlined in my post. I have went back to my old school way of getting rid of them and it involves deleting the GUID Keys that are responsible for reporting the error. Now, keep in mind that all I'm doing by deleting the GUID Keys that are responsible for reporting the error, is just that........stopping the error from being reported in the Event Viewer.

It is by no means a fix; however in the same breath, I couldn't see how the errors were immediately impacting system performance, although the evidence is all over the internet that they do indeed impact or cause system startup failures, overall system performance failures, shut down failures, system freezes, BSOD's and in some circumstances browsing slow-downs.

Now, you may ask: "How in the world are these errors causing BSOD's?" I answer with another question: "Why after all troubleshooting possible is done on a clean install and all drivers are compatible and these errors are the only thing left to fix, could they not be the cause of the problems if they are as harmless as Microsoft claims?"

Basically my assessment of the whole situation is that Microsoft is not going to go back and revise past updates or include hot-fixes to cure everyone's issues on older systems or newer systems alike. In other words, I don't think they are going to go "Back to Formula" just to fix hard encoding of their platform in order to fix what they consider to be a few hiccups and harmless; because if they did, not only would they lose a lot of money, they would also be (indirectly) admitting that they were lying about these being harmless and probably end up in endless lawsuits from other corporations that depend on their OS for day to day business operations that claim they lost money because Microsoft failed to be responsible.

zebal said:

I read trough entry thread and wonder if you understand that letting standard user access permissions to various DCOM applications might pose a security risk.

I don't know if you are asking in general or to a specific reply in this thread; but I can tell you that I am well aware of the risks involved in altering security permissions for DCOM components, which is why I just delete the GUID that is responsible for reporting the error.

As a matter of fact, after my clean install of Windows 10, I left every assigned permission alone and just eliminated the trigger that reports the event. I have a clean event viewer and rarely worry about 10016 errors anymore. If Microsoft wants to self destruct their own platform, I'll let them have at it because it won't cost me anything because I wasn't dumb enough to have a business that relies on a self destructing platform.

You see, Windows 10 to me is an (not by choice) entertainment OS, not a business platform. Even if you own the Enterprise or Pro Editions of Windows, I still feel like that is just waiting for a tragedy to happen. Microsoft seems to think people are more interested in using their computers for entertainment (which is why I can understand people having more than one computer and type of OS) and music.

Computers never use to be about seeing how many components of your entertainment system could be a part of your OS. Now unfortunately, Microsoft seems to think they can handle that task of gaming and entertainment in their OS, and I think they are mistaken to be quite frank about it; simply because they can't even get the basics of their OS in check............meaning simple security protocol permissions that are the staple of any functional OS; and believe it or not, I feel they are doing it on purpose - but don't even ask me why because I'll get on an eight page rant that is too controversial and a hot topic.

zebal said:

is there a technical backgound as to when is it ok and when not?

Unfortunately, there is no simple answer to that because technically their is no background that remains a constant in an evolving platform for an OS.