Event ID 10005 w/ SecurityHealthService and ID 7001 w/ AvastWscReport

JoeMcLutz · 21 Feb 2019

Hi.
I run my Windows 10 Pro and I recently updated to version 1809 (build 17763.316). I have to admit that there are fewer problems than I thought there were and I almost solved most of them but one: I still cannot get rid of Event ID 10005 (DCOM) triggered by SecurityHealthService everytime I turn off/reboot Windows.

I found few things about it and I also tried turning off both SecurityHealthService and wscsvc (Windows Security Center): this solves issue with ID 10005 but triggers ID 7001 (Service Control Manager) with AvastWscReporter service.

I also tried auto/delayed/manual start with SecurityHealtService with no avail.

Any hint please? Thank you. Bye!

edit:
Error: (Source: DCOM) (EventID: 10005) (User: NT AUTHORITY)
Description: DCOM got error "1115" attempting to start the service SecurityHealthService with arguments "Unavailable" in order to run the server:
{2D15188C-D298-4E10-83B2-64666CCBEBBD}

EdTittel · 21 Feb 2019

Have you checked this earlier discussion here at TF: Event ID 10005 error (Windows 10) Solved - Windows 10 Forums. Sounds unrelated, but you never know . . .
HTH,
--Ed--

JoeMcLutz · 21 Feb 2019

EdTittel said:

Have you checked this earlier discussion here at TF: Event ID 10005 error (Windows 10) Solved - Windows 10 Forums. Sounds unrelated, but you never know . . .
HTH,
--Ed--

Yes Ed, but it's not useful in my case.
Thanks.

JoeMcLutz · 22 Feb 2019

*** update ***

I wondered if uninstalling Avast could be of any help and... yes: no more event ID 10005 on system shutdown but, at the restart, here you go another fresh ID 10016 concerning local start authorization for server COM application with CLSID Windows.SecurityCenter.WscDataProtection (no AppID available here) to user NT AUTHORITY\SID SYSTEM (S-1-5-18).

Maybe I should grant full access to SYSTEM about wscsvc (Windows security center service) 'cause the only things SYSTEM cannot do is modify, pause and stop the service. But a) I can't do it (I can't change the owner of the service) and b) it's not safe for security reasons.

I can't do anything further but wait for update from Avast/Microsoft.

JoeMcLutz · 25 Feb 2019

*** update ***
There's no need to uninstall Avast to eradicate Event ID 10005 off the Eventviewer: I can just turn off Avast "File protection" module: just 3 SecurityCenter Error (two ID 16 and one ID 17) and no more ID 10005.
But I don't think it's safe.
So, at the moment, I reactivated "File protection" and keep on taking ID 10005 waiting for something wonderful to happen.

EdTittel · 25 Feb 2019

Good detective work, sir. You might want to mark this one solved, so others can benefit from that effort. Of course, if you want to wait for the 1005 error to get fixed, that's your privilege.
Best wishes,
--Ed--

JoeMcLutz · 25 Feb 2019

Thanks Ed. :)
Solved well... Yes but no.

Anyway, I'll follow your advice 'cause I think there's nothing more a user can do but waiting for both Microsoft and Avast programmers to do something about this issue.
...and thanks for your time.

JoeMcLutz · 09 May 2019

***UPDATE***
As stated by this Avast Forum contributor, a "clean install" (of Windows I suppose - because I've tried with Avast with no avail) should solve the issue. Here's the link:
Avast may be causing Event ID 10005 DistributedCOM error

DeadMule · 09 May 2019

JoeMcLutz said:

***UPDATE***
As stated by this Avast Forum contributor, a "clean install" (of Windows I suppose - because I've tried with Avast with no avail) should solve the issue. Here's the link:
Avast may be causing Event ID 10005 DistributedCOM error

Hm, I have this problem, and it's only showing on a brand new machine which is in fact a "clean" install of Windows, with Avast Premier. Clean installs of Windows are supposed to fix all kinds of things (and sometimes the do), but it's often temporary, problems come back. As I need both Windows 10 and Avast on my computer, I don't think clean-installing any of these items will change anything... Just my opinion, what do I know. I'd love to see a solution.

JoeMcLutz · 17 Jun 2019

DeadMule said:

[...] I'd love to see a solution.

Fortunately the solution was to upgrade Windows 10 Pro from 1809 to 1903: no more 10005 Event IDs. :)