Windows 10 Event ID 10010 and 10016 Errors With DistributedCOM

Hi,

Probably will hold till the next Patch Tuesday!

Exactly... A bit of a PITA but hey, now you know how to fix it, right ?

Best to you all,

fdegrove said:

Hi,

In dcomcnfg it's the "Launch and Activation" permissions that need to be changed for whatever user the Eventlog is claiming is missing.
If that particular user is not listed you'll need to add it first. Can be yourself, system or whatever inbuilt account Eventviewer is listing.

The basic operation is invariably the same, whether Runtimebroker or Immersiveshell, whatever.

Cheers,

Hey all, sorry for posting in an older thread. First time poster here, so I don't know all the forum etiquette

I have followed all the steps by Vaio 7 and others and got to the step mentioned above by fdegrove.

My event log states: "The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {blahblah} and APPID {blahblah} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable)."

The only users I have listed in Runtime Broker > Security > Launch and Activate Permissions > Edit are: ALL APPLICATION PACKAGES and SELF. Those already have Local Activation permissions.

So should I add user NT AUTHORITY\SYSTEM SID (S-1-5-18) or user NT AUTHORITY\SYSTEM or user SYSTEM? Or is it supposed to be something else like administrators?

Hi,

Just click on ADD and in the text box type SYSTEM, click check names.
User SYSTEM will be added to the first screen and you now have to grant this user local permissions (both). Not remote.
Then you need to go back to registry editor and return the initial ownerships for both keys.

Guessing from what you posted I think the first hive key has to be granted to SYSTEM, the second one (App ID) to TrustedInstaller (NT Service\TrustedInstaller). Hard to tell without seeing the actual keys but I assume you have the same DCOM error everyone else has on their systems.

Cheers,

fdegrove said:

Just click on ADD and in the text box type SYSTEM, click check names.
User SYSTEM will be added to the first screen and you now have to grant this user local permissions (both). Not remote.
Then you need to go back to registry editor and return the initial ownerships for both keys.

Guessing from what you posted I think the first hive key has to be granted to SYSTEM, the second one (App ID) to TrustedInstaller (NT Service\TrustedInstaller). Hard to tell without seeing the actual keys but I assume you have the same DCOM error everyone else has on their systems.

Thank you so much for responding!

I didn't add the keys bc I didn't think they were significant. Here are the full event details:

Code:

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160} and APPID {9CA88EE3-ACB7-47C8-AFC4-AB702511C276} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.


EventData
param1: application-specific
param2: Local
param3: Activation
param4: {D63B10C5-BB46-4990-A94F-E40B9D520160}
param5: {9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
param6: NT AUTHORITY
param7: SYSTEM
param8: S-1-5-18
param9: LocalHost (Using LRPC)
param10: Unavailable
param11: Unavailable

I tried my best to follow your instructions. I added user SYSTEM, but I forgot to click "Check Names." I think I just clicked OK. (Should I remove it and add it again?).
Then I checked Allow Local Launch and Allow Local Activation.
Then I went to RegEdit and reverted ownership of CLSID & AppID keys by going to permissions > advanced > change > typing NT SERVICE\TrustedInstaller.
Then I restarted. I hope I did everything right and didn't mess up my registry.

I think the first hive key has to be granted to SYSTEM, the second one (App ID) to TrustedInstaller (NT Service\TrustedInstaller)

Does this mean I should also add user NT Service\TrustedInstaller to Runtime Broker > Security > Launch and Activate Permission and allow local permissions?

Hi,

You're welcome.

I just checked both hive keys and both of them are owned by TrustedInstaller so that's what you need to reset them to.

I tried my best to follow your instructions. I added user SYSTEM, but I forgot to click "Check Names." I think I just clicked OK. (Should I remove it and add it again?).

No need. Just view the "Check Name" thing as an extra measure to make sure you chose the correct name.

Then I went to RegEdit and reverted ownership of CLSID & AppID keys by going to permissions > advanced > change > typing NT SERVICE\TrustedInstaller.
Then I restarted. I hope I did everything right and didn't mess up my registry.

You did right. The DCOM error should gone by now.

Does this mean I should also add user NT Service\TrustedInstaller to Runtime Broker > Security > Launch and Activate Permission and allow local permissions?

No, no. The Event Viewer error message tells you what is missing: in your case user ID "SYSTEM" and if that user is missing in DCOM then that's what you add and nothing else.

Sorry for confusing you.

Cheers,

fdegrove said:

I just checked both hive keys and both of them are owned by TrustedInstaller so that's what you need to reset them to.

No need. Just view the "Check Name" thing as an extra measure to make sure you chose the correct name.

You did right. The DCOM error should gone by now.

No, no. The Event Viewer error message tells you what is missing: in your case user ID "SYSTEM" and if that user is missing in DCOM then that's what you add and nothing else.

Seriously, thank you so much for all your help, guidance and explanations. I'm incredibly grateful. It's really nice of you to so many people on this thread. Thanks again and many times more! :)

Hi,

Now, once we've temporarily changed owner for registry keys from TrustedInstaller to Administrators,

Most hive keys are owned by Trusted Installer but not all them.

[QUOTE][open the Launch and Activation permissions Edit button and depending on the Event Viewer description if it's Local Service or System, click Add, add one of the two and enable the box Local Activation/QUOTE]

You can basically ignore that for now.
In DCOM's console you can edit and grant permissions to everything that is visible in the "users" box.
If the "user" mentioned in the Event Viewer's error is missing from the list then you first need to add that user. Often it is your account (the user), sometimes it is SYSTEM.

Once that's done then you can grant that "User" permissions. Most of the time local ones, not remote.

Also, when finally reverting and reassigning registry permissions to TrustedInstaller, am I supposed to remove the allow Full control check mark from Administrators beforehand? Thank you in advance

No need to do that, just return the ownership to whatever it was before, Trusted Installer, System etc.

After the next reboot, if all went well, the error message should no longer appear.


Cheers,

fdegrove said:

Hi,

Most hive keys are owned by Trusted Installer but not all them.

[open the Launch and Activation permissions Edit button and depending on the Event Viewer description if it's Local Service or System, click Add, add one of the two and enable the box Local Activation]

You can basically ignore that for now.
In DCOM's console you can edit and grant permissions to everything that is visible in the "users" box.
If the "user" mentioned in the Event Viewer's error is missing from the list then you first need to add that user. Often it is your account (the user), sometimes it is SYSTEM.
Once that's done then you can grant that "User" permissions. Most of the time local ones, not remote.
No need to do that, just return the ownership to whatever it was before, Trusted Installer, System etc.
After the next reboot, if all went well, the error message should no longer appear.

Cheers,

Thank you for the very insightful and kind reply. Now I think I do understand the procedure a lot better. Maybe I am a tad too concerned, but I would not like to break anything important, and end up with an unstable system.

Thus, let me rely on your guidance and deep knowledge once more, granted and hoping you have the time and patience to help me out. It is truly appreciated.

Can you please verify that the following passages, specific to my case, are in fact accurate? Thanks for all of the precious advise you provide, to myself and others.



A. First DistributedCOM error with Event ID 10016

Code:

The application-specific permission settings do not grant Local Activation permission 
for the COM Server application 
with CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\SID SYSTEM (S-1-5-18) from address LocalHost (Using LRPC) 
running in the application container Unavailable SID (Unavailable). This security 
permission can be modified using the Component Services administrative tool.

CLSID: {D63B10C5-BB46-4990-A94F-E40B9D520160}

APPID: {9CA88EE3-ACB7-47C8-AFC4-AB702511C276}

User: SYSTEM or NT AUTHORITY\SID SYSTEM (S-1-5-18)

Application: RuntimeBroker



1- Open Regedit with Administrative rights

2- Navigate to HKEY_CLASSES_ROOT > CLSID > {D63B10C5-BB46-4990-A94F-E40B9D520160}

3- Right-click on it and select "Permissions..." option

4- In the new dialog box (image from my machine) click on "Advanced" button

5- At the top, look for "Owner" and click on "Change" button near "TrustedInstaller"

6- In the new dialog box type "Administrators" and click on "Check Names" button (it supposedly converts the name to correct format)

7- Click on "OK" button

8- Select "Administrators" in the first dialog box and check the "Allow" checkbox given for "Full Control" option

9- Click on "Apply" and "OK" buttons

10- Navigate to HKEY_CLASSES_ROOT > APPID > {9CA88EE3-ACB7-47C8-AFC4-AB702511C276}

11- Repeat passages #3-#9

12- Close Regedit

13- Open Component Services with Administrative rights

14- Browse to Console Root > Component Services > Computers > My Computer > DCOM Config

15- Find "RuntimeBroker" from the icon list, right click on it and select "Properties"

16- Navigate to the "Security" tab and click the "Edit" button in the "Launch and Activation Permissions" section

17- In the newly opened dialogue box (Launch and Activation Permission), If "SYSTEM" is missing from the "Group or user names" list section proceed to #18, otherwise skip to #21

18- Click the "Add" button

19- Type in "SYSTEM", that is the User as found per Event ID 10016 from Event Viewer, and click on "Check Names" button (it supposedly converts the name to correct format)

20- Click the "OK" button. You're back in "Launch and Activation Permission" dialogue box

21- Select "SYSTEM" from the "Group or user names" list, and click to place a check in the "Local Activation"/"Allow" box

22- Click the "OK" button

23- Back in the "Security" tab, click the "Apply" button, then keep clicking "OK" until all windows are closed

24- Open Regedit with Administrative rights

25- Reassign ownership back to default "TrustedInstaller" for the two modified CLSID and APPID values

26- In order to do so, type "NT SERVICE\TrustedInstaller" (without quotes) in the dialogue box mentioned at #6, and click the "OK" button

27- Close all windows and exit Regedit

28- Reboot



B. Second DistributedCOM error with Event ID 10016

Code:

The application-specific permission settings do not grant Local Activation permission 
for the COM Server application 
with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
to the user portatile_Asus\SID Marco (S-1-5-21-3351707439-3826623186-4039555236-1002) 
from address LocalHost (Using LRPC) 
running in the application container 
Microsoft.Windows.FeatureOnDemand.InsiderHub_10.0.10586.0_neutral_neutral_cw5n1h2txyewy 
SID 
(S-1-15-2-4016783169-893401051-2237370320-274899566-412088533-2398988950-2155762795). 
This security permission can be modified using the 
Component Services administrative tool.

CLSID: {C2F03A33-21F5-47FA-B4BB-156362A2F239}

APPID: {316CDED5-E4AE-4B15-9113-7055D84DCC97}

User: portatile_Asus\Marco or portatile_Asus\SID Marco (S-1-5-21-3351707439-3826623186-4039555236-1002)

Application: Immersive Shell



1- Open Regedit with Administrative rights

2- Navigate to HKEY_CLASSES_ROOT > CLSID > {C2F03A33-21F5-47FA-B4BB-156362A2F239}

3- Right-click on it and select "Permissions..." option

4- In the new dialog box (image from my machine) click on "Advanced" button

5- At the top, look for "Owner" and click on "Change" button near "TrustedInstaller"

6- In the new dialog box type "Administrators" and click on "Check Names" button (it supposedly converts the name to correct format)

7- Click on "OK" button

8- Select "Administrators" in the first dialog box and check the "Allow" checkbox given for "Full Control" option

9- Click on "Apply" and "OK" buttons

10- Navigate to HKEY_CLASSES_ROOT > APPID > {316CDED5-E4AE-4B15-9113-7055D84DCC97}

11- Repeat passages #3-#9

12- Close Regedit

13- Open Component Services with Administrative rights

14- Browse to Console Root > Component Services > Computers > My Computer > DCOM Config

15- Find "Immersive Shell" from the icon list, right click on it and select "Properties"

16- Navigate to the "Security" tab and click the "Edit" button in the "Launch and Activation Permissions" section

17- In the newly opened dialogue box (Launch and Activation Permission), If "portatile_Asus\Marco" is missing from the "Group or user names" list section proceed to #18, otherwise skip to #21

18- Click the "Add" button

19- Type in "portatile_Asus\Marco", that is the User as found per Event ID 10016 from Event Viewer, and click on "Check Names" button (it supposedly converts the name to correct format)

20- Click the "OK" button. You're back in "Launch and Activation Permission" dialogue box

21- Select "portatile_Asus\Marco" from the "Group or user names" list, and click to place a check in the "Local Activation"/"Allow" box

22- Click the "OK" button

23- Back in the "Security" tab, click the "Apply" button, then keep clicking "OK" until all windows are closed

24- Open Regedit with Administrative rights

25- Reassign ownership back to default "TrustedInstaller" for the two modified CLSID and APPID values

26- In order to do so, type "NT SERVICE\TrustedInstaller" (without quotes) in the dialogue box mentioned at #6, and click the "OK" button

27- Close all windows and exit Regedit

28- Reboot



Could you please check and tell me if both procedures, as exposed above through multiple paragraphs, are correct and safe to perform? As you can see, I've tried to include my own parameters. Is everything truly and completely accurate? Thank you