DistributedCom warnings and other errors in event viewer

sdowney717 · May 10, 2023

What does this mean?
Sometimes this PC also halts, no mouse or keyboard input accepted, then after a minute it works fine again.
This seems to have happened after I did a ' reset this PC' just couple days ago.


Log Name: System
Source: Microsoft-Windows-DistributedCOM
Date: 5/10/2023 7:13:30 AM
Event ID: 10016
Task Category: None
Level: Warning
Keywords: Classic
User: DESKTOP-H2L8KHA\sdown
Computer: DESKTOP-H2L8KHA
Description:
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
and APPID
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
to the user DESKTOP-H2L8KHA\sdown SID (S-1-5-21-3995664575-3804192487-1385624515-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
<EventID Qualifiers="0">10016</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2023-05-10T11:13:30.7838261Z" />
<EventRecordID>883</EventRecordID>
<Correlation ActivityID="{6b3f4e25-c1c4-41b9-ad4e-aa37e9879d9c}" />
<Execution ProcessID="568" ThreadID="1880" />
<Channel>System</Channel>
<Computer>DESKTOP-H2L8KHA</Computer>
<Security UserID="S-1-5-21-3995664575-3804192487-1385624515-1001" />
</System>
<EventData>
<Data Name="param1">application-specific</Data>
<Data Name="param2">Local</Data>
<Data Name="param3">Activation</Data>
<Data Name="param4">{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}</Data>
<Data Name="param5">{15C20B67-12E7-4BB6-92BB-7AFF07997402}</Data>
<Data Name="param6">DESKTOP-H2L8KHA</Data>
<Data Name="param7">sdown</Data>
<Data Name="param8">S-1-5-21-3995664575-3804192487-1385624515-1001</Data>
<Data Name="param9">LocalHost (Using LRPC)</Data>
<Data Name="param10">Unavailable</Data>
<Data Name="param11">Unavailable</Data>
</EventData>
</Event>

glasskuter · May 10, 2023

DCOM Events 10016 are perfectly normal. Why Certain DCOM 10016 Events Don't Matter - Windows 10 Help Forums

The event viewer can be a daunting experience, because all healthy Windows operating systems are constantly generating events and errors, and Windows is designed to overcome those events without the user even being aware a problem occurred. That is the way Windows is designed.
Microsoft indicates you can and should ignore those errors, and unless your system is experiencing problems, there is no need for further action. The event viewer is meant to be used only if a system is having problems and even then only persistent critical and error level events should be looked into.

OAT · May 10, 2023

Glasskuter said it all and one should stay away from the event logs for their own mental health.

This said the key is also here: <Data Name="param7">sdown</Data>
You will get those every time you shut down your system as DCOM is unable to call objects since they are no longer available.