Multiple DistributedCOM errors, system freezing, etc

Question

I've been trying for several months to solve a problem where my system would freeze up while working. Occasionally it would be while web browsing, other times playing games, but I can't find a real pattern.

When I check the event viewer after rebooting I often find errors similar to the following; 

Log Name:      System

Source:        Microsoft-Windows-DistributedCOM

Date:          4/17/2018 6:26:38 PM

Event ID:      10016

Task Category: None

Level:         Error

Keywords:      Classic

User:          DEEPTHOUGHT\samue

Computer:      deepthought

Description:

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 

{D63B10C5-BB46-4990-A94F-E40B9D520160}

 and APPID 

{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}

 to the user DEEPTHOUGHT\samue SID (S-1-5-21-4100534078-2505195061-3857586593-1002) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />

    <EventID Qualifiers="0">10016</EventID>

    <Version>0</Version>

    <Level>2</Level>

    <Task>0</Task>

    <Opcode>0</Opcode>

    <Keywords>0x8080000000000000</Keywords>

    <TimeCreated SystemTime="2018-04-17T22:26:38.249263700Z" />

    <EventRecordID>1668</EventRecordID>

    <Correlation />

    <Execution ProcessID="776" ThreadID="3804" />

    <Channel>System</Channel>

    <Computer>deepthought</Computer>

    <Security UserID="S-1-5-21-4100534078-2505195061-3857586593-1002" />

  </System>

  <EventData>

    <Data Name="param1">application-specific</Data>

    <Data Name="param2">Local</Data>

    <Data Name="param3">Activation</Data>

    <Data Name="param4">{D63B10C5-BB46-4990-A94F-E40B9D520160}</Data>

    <Data Name="param5">{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}</Data>

    <Data Name="param6">DEEPTHOUGHT</Data>

    <Data Name="param7">samue</Data>

    <Data Name="param8">S-1-5-21-4100534078-2505195061-3857586593-1002</Data>

    <Data Name="param9">LocalHost (Using LRPC)</Data>

    <Data Name="param10">Unavailable</Data>

    <Data Name="param11">Unavailable</Data>

  </EventData>

</Event>

The CLSID and APPID occasionally are different than above (CLSID {6B3B8D23-FA8D-40B9-8DBD-B950333E2C52} and APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} is another example.

I've tried adjusting persmissions but still get errors. I eventually ran in to so many problems and crashes that I did a reformat and reinstall of Win10. It's ran fine for a few days but now is starting to freeze again.

I've run a memtest in the past but not overnight, just about an hour but no errors.

Any help is appreciated.

Answer 1

This issue is being experienced by many Windows 10 users and has nothing to do with hardware at all. The key problem is that Microsoft are updating the operating system and the process is incorrectly setting the launch permissions on a number of DCOM entries. Lately we are find permissions with an unknown SID which was the users SID prior to the Build update.

This article by Microsoft explains what is occurring but the statement "These 10016 events are recorded when Microsoft components tries to access DCOM components without the required permissions. In this case, this is expected and by design."

A further paragraph states "These events can be safely ignored because they do not adversely affect functionality and are by design." This is a cop out and complete rubbish. The launch permission errors are causing system slowdowns, Shell issues, systems hanging, printer spooler 100% CPU locking issues for many clients. 

See for full article. DCOM event ID 10016 is logged in Windows

These are the affected DCOM components and keys we find on many system after updates.

1/ RunTimeBroker - 1st entry

"HKEY_CLASSES_ROOT\CLSID{D63B10C5-BB46-4990-A94F-E40B9D520160}"

"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}"

2/ RunTimeBroker - 2nd entry

"HKEY_CLASSES_ROOT\CLSID{2593f8b9-4eaf-457c-b68a-50f6b8ea6b54}"

"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID{15c20b67-12e7-4bb6-92bb-7aff07997402}"

3/ ShellServiceHost

"HKEY_CLASSES_ROOT\CLSID{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}"

"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}"

4/ Windows Management and Instrumentation

"HKEY_CLASSES_ROOT\CLSID{8BC3F05E-D86B-11D0-A075-00C04FB68820}"

"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID{8BC3F05E-D86B-11D0-A075-00C04FB68820}"

5/ Immersive Shell

"HKEY_CLASSES_ROOT\CLSID{C2F03A33-21F5-47FA-B4BB-156362A2F239}"

"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID{316CDED5-E4AE-4B15-9113-7055D84DCC97}"

To fix these issues:

Download SetACL.exe from https://helgeklein.com/setacl/

Copy to c:\windows\system32

Enable the built-in Administrator account, follow these steps:

Open Command Prompt (Admin).

In the elevated Command Prompt, type the following command and then press Enter.

Net user administrator /active:yes

Run the steps again to fix the error message.

To disable the built-in Administrator account, simply type Net user administrator /active:no in the elevated Command Prompt.

Create text file scripts in this format: (Change CLSID and APPID for each DCOM.

reg query "HKEY_CLASSES_ROOT\CLSID{D63B10C5-BB46-4990-A94F-E40B9D520160}" /ve

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}" /ve

SetACL.exe -on "HKEY_CLASSES_ROOT\CLSID{D63B10C5-BB46-4990-A94F-E40B9D520160}" -ot reg -actn setowner -ownr "n:Administrators"

SetACL.exe -on "HKEY_CLASSES_ROOT\CLSID{D63B10C5-BB46-4990-A94F-E40B9D520160}" -ot reg -actn ace -ace "n:Administrators;p:full"

SetACL.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}" -ot reg -actn setowner -ownr "n:Administrators"

SetACL.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}" -ot reg -actn ace -ace "n:Administrators;p:full"

SetACL.exe -on "HKEY_CLASSES_ROOT\CLSID{D63B10C5-BB46-4990-A94F-E40B9D520160}" -ot reg -actn setowner -ownr "n:SYSTEM"

SetACL.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}" -ot reg -actn setowner -ownr "n:NT SERVICE\TrustedInstaller"

Copy and paste into elevated command prompt.

Open Component Services and check launch and Activation permissions. If they are still not correct, copy and paste the four middle script lines to take ownership. Refresh the Component Services view and edit launch permissions.

Compare permission entries to a clean healthy system to ensure all accounts are represented.

The main ones are SYSTEM, LOCAL SERVICE and NETWORK SERVICE

Once each are given Local Launch and Local Activation Allow permissions, run the last two script lines to set the Trusted Installer as owner and disable local administrator.

Reboot and check event log to confirm permissions are working.

Answer 2

a quick update - a registry search for the driver name led to the "Windows Portable Device" section. I ran the driver verifier and everything came back ok. I don't see any errors on Device Manager either.

Answer 3

I am going to recommend you downgrade to Windows 10 1703.

Step 1: download Windows 10 1703 from the following link:

https://tb.rg-adguard.net/index.php?sid=74a7cf5...

Choose the following:

• Windows Final
• Windows 10, version 1703
• Windows 10 Pro + Home
• English
• x64 (64 bit) x32 (32 bit)

Step 2: create a bootable copy

https://answers.microsoft.com/en-us/windows/wik...

Step 3: perform a custom install

http://answers.microsoft.com/en-us/insider/wiki...

You should backup your files before downgrading.

Applications will need to be reinstalled.

The custom install will archive your files, so you can recover them from the Windows.old folder - make sure you follow the instructions to the letter.

There are some compatibility issues with Windows 10 version 1709 and certain hardware or software. There is no explanation why a lot of these problems are happening in Windows 10 1709, but the release is significantly flawed. Software and Hardware that once worked in previous versions, just suddenly stops working in Windows 10 1709 after an upgrade and sometimes loses functionality or stability.

Answer 4

System is homemade: 

OS Name Microsoft Windows 10 Home

Version 10.0.16299 Build 16299

System Manufacturer BIOSTAR Group

System Model TA970

System Type x64-based PC

System SKU None

Processor AMD FX(tm)-6300 Six-Core Processor, 3500 Mhz, 3 Core(s), 6 Logical Processor(s)

BIOS Version/Date American Megatrends Inc. 4.6.4, 8/7/2014

Winver lists build as Version 1709

Way back when this system ran Windows 7 Home Premium but I've been running Windows 10 Home since it came out, mostly without issue.

Answer 5

What is the exact make and model?

Open Start, type: system information

Hit Enter

Click System summary

Look in the right pane

Copy the system sku info into reply here.

See example: https://imgur.com/qzektpA

Which version of Windows 10 is currently installed? See how to verify:

https://answers.microsoft.com/en-us/windows/wik...

Which version and edition Windows did you originally upgrade from or was installed prior to your current version:

Windows 10 - 1703, 1607, 1511, 1507 (build 10240)

Windows 7 Starter, Home Basic, Home Premium, Windows 8.0 Core, Windows 8.1 Windows 7 Professional, Windows 7 Ultimate, Windows 8.0 Pro, Windows 8.1 Pro