Event ID: 10016 Microsoft-Windows-DistributedCOM

Question

What does this mean and how to fix?

Log Name: System
Source: Microsoft-Windows-DistributedCOM
Date: 10/29/2021 11:29:56 AM
Event ID: 10016
Task Category: None
Level: Warning
Keywords: Classic
User:
Computer:
Description:
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
and APPID
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
to the user PRIVATE-THINK\SID (S-1-5-21-2595732039-1992755743-2030151454-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
<EventID Qualifiers="0">10016</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2021-10-29T03:29:56.5253692Z" />
<EventRecordID>24106</EventRecordID>
<Correlation ActivityID="{99141e28-4e2c-49d7-8b0d-fc0ee63247aa}" />
<Execution ProcessID="1352" ThreadID="22688" />
<Channel>System</Channel>
<Computer>PRIVATE-THINK</Computer>
<Security UserID="S-1-5-21-2595732039-1992755743-2030151454-1001" />
</System>
<EventData>
<Data Name="param1">application-specific</Data>
<Data Name="param2">Local</Data>
<Data Name="param3">Activation</Data>
<Data Name="param4">{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}</Data>
<Data Name="param5">{15C20B67-12E7-4BB6-92BB-7AFF07997402}</Data>
<Data Name="param6">PRIVATE-THINK</Data>
<Data Name="param7">private</Data>
<Data Name="param8">S-1-5-21-2595732039-1992755743-2030151454-1001</Data>
<Data Name="param9">LocalHost (Using LRPC)</Data>
<Data Name="param10">Unavailable</Data>
<Data Name="param11">Unavailable</Data>
</EventData>
</Event>

Answer 1

• Open the registry editor as an administrator and navigate to HKEY_CLASSES_ROOT\CLSID{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}. If you are in the right location, you also see the APPID as a value. Remember the application name (PerAppRuntimeBroker), you can see in the Data column, the corresponding Name column shows (Default). App name example
• Right click the {2593F8B9-4EAF-457C-B68A-50F6B8EA6B54} and click Permissions, then choose Advanced.
• In the advance security setting window, click Change and type your administrator account. Then click OK.
• In the "Permissions for..." windows, select the Administrators and activate the Full Permissions checkbox.
• Repeat step 1 to 4 to add permissions for APPID{15C20B67-12E7-4BB6-92BB-7AFF07997402}.
• Open Component Services as administrator. Navigate to Component Services-Computers-My Computer-DCOM Config. Find the application by application name remembered in step 1 and right click the Properties.
• Go to the Security tab, choose the appropriate action. You can choose Launch and Activation Permissions, set to Customize, and Edit.
• Click the name that applies to you (PRIVATE-THINK\wongw) and click the appropriate permission.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

Hello,

From https://learn.microsoft.com/en-US/troubleshoot/windows-client/application-management/event-10016-logged-when-accessing-dcom, Microsoft says:

"These events can be safely ignored because they do not adversely affect functionality and are by design. This is the recommend action for these events."

Hope this helps!