New
#1
Why Certain DCOM 10016 Events Don't Matter
Here at TenForums.com we get lots of questions about Event ID 10016, which shows up in Event Viewer on nearly all Windows 10 PCs (and in modern Server versions as well, as it turns out). People who post these questions may even be irritated or upset. Usually, they want to make those events go away, and absent themselves from the Event log.
Thanks to some excellent sleuthing work from long-time member @f14tomcat, I can cite a Microsoft Support Note to explain that these events are perfectly normal. In fact, they do not need to be fixed, removed, or otherwise mitigated. The title of the note is "DCOM event ID 10016 is logged in Windows." As I write this post, the note reports it was last updated on April 30, 2018. It also reports that it applies to the following Windows versions:
How can I assert that certain DCOM 10016 events don't matter? Because the note makes it clear that any such events that mention "application-specific settings do not grant Local Activation permission" are normal for the afore-cited Windows versions. Here's the meaty part of the Support Note that explains things completely:Windows Server version 1803, Windows 10 version 1803, Windows 10 version 1709, Windows 10 Version 1703, Windows 10 Version 1607, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Server 2016 Standard edition Nano Server installation option, Windows Server 2016 Datacenter edition Nano Server installation option, and Windows Server 2016 Essentials
Cause
These 10016 events are recorded when Microsoft components tries to access DCOM components without the required permissions. In this case, this is expected and by design. A coding pattern has been implemented where the code first tries to access the DCOM components with one set of parameters. If the first attempt is unsuccessful, it tries again with another set of parameters. The reason why it does not skip the first attempt is because there are scenarios where it can succeed. In those scenarios, that is preferable.
Workaround
These events can be safely ignored because they do not adversely affect functionality and are by design. This is the recommended action for these events.
What if I MUST Silence These Events Anyway?
Some Windows 10 users won't like or care about this explanation. They simply won't settle for anything less than a clean Event Viewer on their PCs.
For such folks, the note provides instructions on how to suppress those events in the Event Viewer "by creating a filter and manually editing the filter's XML query." Please consult the Note for detailed instructions. Please also be aware that if you choose to silence these events, you won't be informed if a real, noteworthy DCOM event occurs on your system. If you search these Forums, you can also find other ways to handle these events, too. These include editing the registry to suppress DCOM events completely (subject to the same observation about cutting oneself off from information about real errors), and changing permissions to grant the necessary system components the ability to alter DCOM component data (this is the safest way to prevent those events from recurring, but must be repeated for each feature upgrade that comes along).
For the rest of us -- including me -- we can safely and completely ignore those events. They do not indicate problems or trouble, and occur by deliberate design.
HTH,
--Ed--
Last edited by EdTittel; 12 May 2018 at 09:53.