A family of Microsoft on-premises document management and storage systems.
Hi @adil ,
These 10016 events are recorded when Microsoft components tries to access DCOM components without the required permissions.
As per Microsoft, you could ignore these 10016 Event IDs and it is not recommended to try to fix through manipulating security of objects and such to circumvent as these occur by design.
If desired, advanced users and IT professionals can suppress these events from view in the Event Viewer by creating a filter and manually editing the filter’s XML query similar to the following:
<QueryList>
<Query Id="0" Path="System">
<Select Path="System">*</Select>
<Suppress Path="System">
*[System[(EventID=10016)]]
and
*[EventData[
(
Data[@Name='param4'] and Data='{D63B10C5-BB46-4990-A94F-E40B9D520160}' and
Data[@Name='param5'] and Data='{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}'
)
or
(
Data[@Name='param4'] and Data='{260EB9DE-5CBE-4BFF-A99A-3710AF55BF1E}' and
Data[@Name='param5'] and Data='{260EB9DE-5CBE-4BFF-A99A-3710AF55BF1E}'
)
or
(
Data[@Name='param4'] and Data='{C2F03A33-21F5-47FA-B4BB-156362A2F239}' and
Data[@Name='param5'] and Data='{316CDED5-E4AE-4B15-9113-7055D84DCC97}'
)
or
(
Data[@Name='param4'] and Data='{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}' and
Data[@Name='param5'] and Data='{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}'
)
or
(
Data[@Name='param4'] and Data='{C2F03A33-21F5-47FA-B4BB-156362A2F239}' and
Data[@Name='param5'] and Data='{316CDED5-E4AE-4B15-9113-7055D84DCC97}'
)
]]
</Suppress>
</Query>
</QueryList>
More information, please refer to this article DCOM event ID 10016 is logged in Windows.
Thanks,
Echo Du
====================
If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.