Event Viewer: Filter Administrative Events?

The Administrative Events window quickly fills up with DistributedCOM warnings and errors. I tried to fix this, but in the end, couldn't get past the final step:

Fixing DistributedCOM error 10016

Failing that (any other ideas folks on how to fix rather than hide the errors??), I would at least like to filter out all event IDs 10010 and 10016: there are so many after a few weeks that it's hard to navigate through the mass of them to find other information. I should be able to go to Administrative Events and in Actions choose 'Filter Current Custom View'. But everything is greyed out (nothing at all is clickable) in the 'Filter Current Custom View' window, even though I log into Event Viewer as Administrator.

How do I proceed in order to filter those events from Administrative Events?

(Creating a new custom filter is not what I want to do BTW, and in any case (having tried it), setting -10010,-10016 as the filter removes a whole lot of other events present in Administrative Events, for some reason).

Thank you.

Windows 10 Pro 18363.1379

martinlest said:

The Administrative Events window quickly fills up with DistributedCOM warnings and errors. I tried to fix this, but in the end, couldn't get past the final step:
Fixing DistributedCOM error 10016

Failing that (any other ideas folks on how to fix rather than hide the errors??), I would at least like to filter out all event IDs 10010 and 10016: there are so many after a few weeks that it's hard to navigate through the mass of them to find other information. I should be able to go to Administrative Events and in Actions choose 'Filter Current Custom View'. But everything is greyed out (nothing at all is clickable) in the 'Filter Current Custom View' window, even though I log into Event Viewer as Administrator.

How do I proceed in order to filter those events from Administrative Events?

(Creating a new custom filter is not what I want to do BTW, and in any case (having tried it), setting -10010,-10016 as the filter removes a whole lot of other events present in Administrative Events, for some reason).

Thank you.

Windows 10 Pro 18363.1379

Hi. This is an ongoing issue for a very long time. I tried to fix it once by making take ownership changes but ultimately caused major problems. Fortunately I had a Macrium Reflect backup image to restore the system. The only thing that MS did was change them from errors to warnings. Myself and I think many others have just learned to live with these warnings as they do not cause any problems at all.

@martinlest, see this post for why the errors don't matter, and a link to detailed instructions in the note from MS as to how to edit the XML query if you don't want to see them...

Why Certain DCOM 10016 Events Don't Matter

Thanks, I'll look at those options and post back.

I am OK with the events remaining unfixed, especially as it sounds risky to try to eliminate them: as I say, their only inconvenience to me is how they take over the Event Viewer log after a while and make it harder to navigate. Not a 'deal breaker' of course but it'd be good to have them excluded from the log.

That seemed to work fine, thank you. I got similar dialogues to when I created a custom filter earlier, but when I did that I got an error message at the end and EV crashed... I can't recall exactly what happened to give further details I'm afraid.

The only bit I don't see is in your para#5: "... then make the changes on the dialog that appears or in the xml tab." What dialogue list is supposed to appear and (as none does) what do I change in the XML tab?

As posted by Bree many / most dcom events can be ignored.

The opening post displayed application events.
Most often these are system events.

Code:

Event[458]:
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2020-11-14T05:03:12.008
  Event ID: 10010
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: Classic
  User: S-1-5-21-163296743-1907596348-653451803-1001
  User Name: DESKTOP-9HEBUKS\aaaaaaaa
  Computer: DESKTOP-9HEBUKS
  Description: 
The server {9BA05972-F6A8-11CF-A442-00A0C90A8F39} did not register with DCOM within the required timeout.