U današnjem ćemo postu identificirati uzrok, a zatim ponuditi moguća rješenja za problem pogreške DCOM (DistributedCOM) ID događaja 10016^{(DCOM (DistributedCOM) Event ID 10016)} koja bi se mogla pojaviti u pregledniku događaja u sustavu Windows^(Windows) tijekom normalnog rada sustava Windows 10 .

Model  distribuiranih komponenti (DCOM)^{(Distributed Component Object Model (DCOM))} sastavni je aspekt umrežene komunikacije na Windows računalima. To je vlasnička Microsoftova^(Microsoft) tehnologija koja djeluje svaki put kada se aplikacija poveže s internetom. Tradicionalni COM može pristupiti samo informacijama na istom stroju, dok DCOM može pristupiti podacima na udaljenim poslužiteljima.

Na primjer, mnoge web stranice i usluge koriste skripte koje pristupaju udaljenom poslužitelju. Kada vaš sustav uputi zahtjev pomoću skripte ili na neki drugi način, DCOM prosljeđuje zahtjev određenom objektu skripte. S obzirom na to koliko često moderne aplikacije koriste mrežnu vezu i našu opću upotrebu računala, možete vidjeti koliko često se DCOM koristi.

Pogreška DCOM ID događaja 10016

Možda ćete primijetiti sljedeći događaj 10016 prijavljen u zapisnicima događaja sustava na računalu koje radi sa sustavom Windows 10^{(Windows 10)} , Windows Server 2016 , Windows Server 2019, Windows Server , verzija 1903 ili Windows Server 1909 :

Source: Microsoft-Windows-DistributedCOM
Event ID: 10016
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Obično ćete naići na gornju pogrešku koja je prijavljena u pregledniku događaja. Međutim, važno je napomenuti da postoje varijacije pogreške ID-a događaja 10016 . ^{(Event ID 10016)}Ipak^{(Nevertheless)} , postupak za ublažavanje pogreške u biti je isti.

DCOM pogreška obično se javlja kada aplikacija ili usluga pokušavaju koristiti DCOM , ali nemaju odgovarajuća dopuštenja. Većinu vremena DCOM pogreške neće utjecati na vaš sustav, osim što će začepiti preglednik^(Viewer) događaja . Ovih 10016 događaja bilježi se kada Microsoftove^(Microsoft) komponente pokušaju pristupiti DCOM komponentama bez potrebnih dopuštenja. U ovom slučaju, to je očekivano i po dizajnu.

DCOM pogreške se ne brinuti - možete ih sigurno zanemariti. Međutim, postoje postupci koje možete slijediti kako biste riješili pogrešku s ID-om događaja 10016^{(ID 10016)} kad god se pojavi.

Kako riješiti pogrešku DCOM događaja ID 10016

Kako bi riješio ovaj problem, Microsoft predlaže stvaranje XML filtera za suzbijanje greške DCOM događaja ID 10016 .

Evo kako:

• Otvorite preglednik događaja^{(Event Viewer)} ( Pritisnite tipku Windows^{(Press Windows)} + R. U dijaloškom okviru Pokreni upišite ^(Run)eventvwr i pritisnite Enter).
• Pritisnite Windows Dnevnici^{(Windows Logs)} > Sustav^(System) .
• Kliknite  Filtriraj trenutni zapisnik ^{(Filter current log )} ispod okna Radnje .^(Action)
• Odaberite karticu XML i označite opciju Uredi upit ručno .^{(Edit query manually)}
• Kopirajte i zalijepite sljedeći XML tekst u dijaloški okvir filtra.

<QueryList>
  <Query Id="0" Path="System">
    <Select Path="System">*</Select>
    <Suppress Path="System">
      *[System[(EventID=10016)]]
      and
      *[EventData[
        (
          Data[@Name='param4'] and Data='{D63B10C5-BB46-4990-A94F-E40B9D520160}' and
          Data[@Name='param5'] and Data='{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}' and
          Data[@Name='param8'] and Data='S-1-5-18'
        ) 
        or
        (
          Data[@Name='param4'] and Data='{260EB9DE-5CBE-4BFF-A99A-3710AF55BF1E}' and
          Data[@Name='param5'] and Data='{260EB9DE-5CBE-4BFF-A99A-3710AF55BF1E}'
        ) 
        or
        (
          Data[@Name='param4'] and Data='{C2F03A33-21F5-47FA-B4BB-156362A2F239}' and
          Data[@Name='param5'] and Data='{316CDED5-E4AE-4B15-9113-7055D84DCC97}' and
          Data[@Name='param8'] and Data='S-1-5-19'
        )
        or
        (
          Data[@Name='param4'] and Data='{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}' and
          Data[@Name='param5'] and Data='{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}' and
          Data[@Name='param8'] and Data='S-1-5-19'
        ) 
      ]]
    </Suppress>
  </Query>
</QueryList>

U ovom upitu  param4  odgovara aplikaciji COM poslužitelja ^{(COM Server)}CLSID ,  param5  odgovara APPID-u, a  param8  odgovara sigurnosnom kontekstu SID -a, a svi su zabilježeni u 10016 zapisnika događaja.

• Kliknite OK .

Unosi DCOM^(DCOM) pogreške s ID -om događaja 10016^{(Event ID 10016)} sada su skriveni od pogleda.

Alternativno, možete riješiti problem s DCOM dopuštenjima pomoću ^{(DCOM Permissions)}uređivača registra^{(Registry Editor)} i alata DCom Config .

Evo kako:

Popravak uključuje ugađanje registra – stoga se kao mjera opreza preporučuje da napravite sigurnosnu kopiju registra^{(back up the registry)} ili stvorite točku vraćanja sustava .

Kako biste spriječili bilježenje događaja, slijedite ove korake da biste dali dopuštenje DCOM komponentama koje imaju specifične CLSID-ove^(CLSIDs) i APPID^(APPIDs) -ove .

Prvo ćete morati shvatiti koji je proces ili usluga povezana s ID-om CLASS-a^{(CLASS ID)} navedenim u pogrešci. Da biste to učinili, kopirajte CLSID naveden u opisu događaja. U ovom slučaju, to je {D63B10C5-BB46-4990-A94F-E40B9D520160} . Obavezno kopirajte i obje vitičaste zagrade.

Sada pokrenite uređivač registra . Kada otvorite uređivač registra, kliknite na  Uredi^(Edit)  , a zatim  na Pronađi^(Find) . Samo naprijed i zalijepite CLSID u okvir za pretraživanje i pritisnite Enter .

Registar će sada pokrenuti pretragu. Nakon nekog vremena, trebali biste dobiti rezultat pod ključem HK_CLASSES_ROOT\CLSID  . Na desnoj strani trebao bi imati dvije tipke, a  zadani^(Default) bi trebao navesti naziv usluge. U ovom slučaju, to bi trebao biti RuntimeBroker .

Sada kada ste identificirali proces, možete nastaviti na sljedeći način kako biste ispravili pogrešku.

• Ipak, u uređivaču registra idite na sljedeći AppID ključ povezan s RuntimeBrokerom:

HKEY_CLASSES_ROOT\AppID\{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}

Prema zadanim postavkama, TrustedInstaller posjeduje ovaj ključ registra i njegove potključeve. Postavite administratora^{(Set Administrator)} kao vlasnika ključa i njegovih potključeva. Pogledajte  kako preuzeti vlasništvo nad ključevima registra^{(how to take ownership of registry keys)}  za više informacija.

• Nakon postavljanja administratora^{(Administrators)}  kao vlasnika, dodijelite  grupu administratora^{(Administrators)}  i  SISTEM^(SYSTEM)  račun imaju dopuštenje pune kontrole za ključ i potključeve.^{(Full Control)}
• Izađite iz uređivača registra.

Zatim pokrenite alat za konfiguraciju DCOM -a (pritisnite tipku ^{(DCOM Configuration)}Windows + R. U dijaloškom okviru Pokreni upišite ^(Run)dcomcnfg.exe  i pritisnite Enter.

• Kliknite Usluge komponenti^{(Component Services)} > Računala^(Computers) > Moje^{(My Comput)} računalo > DCOM Config .
• Desnom tipkom miša kliknite^{(Right-click)} aplikaciju koja odgovara AppID -u koji je zabilježen u zapisniku događaja, a zatim odaberite Svojstva^(Properties) .

Naziv aplikacije u ovom primjeru je RuntimeBroker koji smo ranije identificirali. Ako alat DCom Config navodi dva unosa RuntimeBroker . Da biste pronašli pravu, desnom tipkom miša kliknite stavku i kliknite Svojstva te uparite ID aplikacije^{(App ID)} s onim u registru.

• Odaberite karticu Sigurnost^(Security) .
• U odjeljku Dopuštenja za pokretanje i aktivaciju^{(Launch and Activation Permissions)} odaberite Prilagodi^(Customize) i kliknite Uredi^(Edit) .

Ako je gumb Uredi^(Edit) zasivljen na stranici Svojstva^(Properties) aplikacije RuntimeBroker u DCOM Config -u , morat ćete provjeriti dopuštenja ključa registra AppID -a.^(AppID)

• Pod Grupa ili korisnička imena^{(Group or user names)} odaberite Dodaj^(Add) .
• Unesite^(Enter) grupu ili korisničko ime koje je zabilježeno u zapisniku događaja. Na primjer, račun zabilježen u zapisniku može biti NT AUTHORITY\NETWORK SERVICE , NT AUTHORITY\SYSTEM ili neka druga grupa ili račun.
• Kliknite OK .
• Dodijelite^{(Assign Local Activation)} dopuštenje za lokalnu aktivaciju za tog korisnika ili grupu koju ste dodali i dovršite postupak.

Ovaj postupak sprječava pogreške u zapisniku događaja ID događaja^{(Event ID)} : 10016 koji se odnosi na DCOM dopuštenja.

Napomena^(Note) : Microsoft ne preporuča metodu mijenjanja dopuštenja na komponentama DCOM -a kako bi spriječio evidentiranje ove pogreške jer te pogreške ne utječu negativno na funkcionalnost i izmjena dozvola može imati neželjene nuspojave.

Hope this helps!

How to fix DCOM Event ID 10016 error on Windows 10

In today’s post, we will identify the cause and then provide the possible solutions to the issue of DCOM (DistributedCOM) Event ID 10016 error that might show up in the Windows event viewer in the course of normal operations of Windows 10.

The Distributed Component Object Model (DCOM) is an integral aspect of networked communication on Windows computers. It is a proprietary Microsoft technology that whirs into action every time an application makes a connection to the internet. A traditional COM can only access information on the same machine, whereas DCOM can access data on remote servers.

For example, many websites and services use scripts that access a remote server. When your system makes a request using a script or otherwise, DCOM forwards the request to the specific script object. Given how frequently modern applications use a network connection and our general use of computers, you can see how frequently DCOM comes into use.

DCOM Event ID 10016 error

You may notice the below event 10016 logged in the system event logs on a computer that is running Windows 10, Windows Server 2016, Windows Server 2019, Windows Server, version 1903 or Windows Server 1909:

Source: Microsoft-Windows-DistributedCOM
Event ID: 10016
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Typically, you’ll encounter the above error logged in the event viewer. However, it’s noteworthy that there are variations of the Event ID 10016 error. Nevertheless, the procedure to mitigate the error is essentially the same.

A DCOM error usually occurs when an application or service attempts to use DCOM but does not have the proper permissions. Most of the time, DCOM errors won’t affect your system, other than clogging up your Event Viewer. These 10016 events are recorded when Microsoft components try to access DCOM components without the required permissions. In this case, this is expected and by design.

DCOM errors are nothing to worry about – you can safely ignore them. However, there are procedures you can follow to resolve the event ID 10016 error whenever it occurs.

How to resolve DCOM event ID 10016 error

To resolve this issue, Microsoft suggests creating an XML filter to suppress the DCOM event ID 10016 error.

Here’s how:

• Open Event Viewer (Press Windows key + R. In the Run dialog box, type eventvwr and hit Enter).
• Ckick Windows Logs > System.
• Click Filter current log under the Action pane.
• Select the XML tab and check Edit query manually option.
• Copy and paste the following XML text to the filter dialog.

<QueryList>
  <Query Id="0" Path="System">
    <Select Path="System">*</Select>
    <Suppress Path="System">
      *[System[(EventID=10016)]]
      and
      *[EventData[
        (
          Data[@Name='param4'] and Data='{D63B10C5-BB46-4990-A94F-E40B9D520160}' and
          Data[@Name='param5'] and Data='{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}' and
          Data[@Name='param8'] and Data='S-1-5-18'
        ) 
        or
        (
          Data[@Name='param4'] and Data='{260EB9DE-5CBE-4BFF-A99A-3710AF55BF1E}' and
          Data[@Name='param5'] and Data='{260EB9DE-5CBE-4BFF-A99A-3710AF55BF1E}'
        ) 
        or
        (
          Data[@Name='param4'] and Data='{C2F03A33-21F5-47FA-B4BB-156362A2F239}' and
          Data[@Name='param5'] and Data='{316CDED5-E4AE-4B15-9113-7055D84DCC97}' and
          Data[@Name='param8'] and Data='S-1-5-19'
        )
        or
        (
          Data[@Name='param4'] and Data='{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}' and
          Data[@Name='param5'] and Data='{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}' and
          Data[@Name='param8'] and Data='S-1-5-19'
        ) 
      ]]
    </Suppress>
  </Query>
</QueryList>

In this query, param4 corresponds to the COM Server application CLSID, param5 corresponds to the APPID, and param8 corresponds to the security context SID, all of which are recorded in the 10016 event logs.

• Click OK.

The DCOM error entries with the Event ID 10016 are now hidden from view.

Alternatively, you can fix DCOM Permissions issue using Registry Editor & DCom Config tool.

Here’s how:

The fix involves a registry tweak – so as a precautionary measure, it’s recommended that you back up the registry or create a system restore point.

To prevent the events from being logged, follow these steps to grant permission to the DCOM components that have specific CLSIDs and APPIDs.

First, you’ll need to figure out which process or service is associated with the CLASS ID listed in the error. To do this, go ahead and copy the CLSID listed in the event description. In this case, it is {D63B10C5-BB46-4990-A94F-E40B9D520160}. Make sure to copy both the curly braces also.

Now, launch Registry Editor. When you have the registry editor opened, click on Edit and then Find. Go ahead and paste the CLSID into the search box and hit Enter.

The registry will now initiate a search. After some time, you should get a result under the HK_CLASSES_ROOT\CLSID key. On the right-hand side, it should have two keys and the Default one should list out the name of the service. In this case, it should be RuntimeBroker.

Now that you have identified the process, you can now proceed as follows to fix the error.

• Still, in the registry editor, navigate to the following AppID key associated with the RuntimeBroker:

HKEY_CLASSES_ROOT\AppID\{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}

By default, TrustedInstaller owns this registry key and its subkeys. Set Administrator as the owner of the key and its subkeys. See how to take ownership of registry keys for more information.

• After setting Administrators as the owner, assign Administrators group and SYSTEM account have Full Control permission for the key and subkeys.
• Exit the Registry Editor.

Next, start the DCOM Configuration tool (press Windows key + R. In the Run dialog box, type dcomcnfg.exe and hit Enter.

• Click Component Services > Computers > My Computer > DCOM Config.
• Right-click the application that corresponds to the AppID that’s recorded in the event log, and then select Properties.

The application name in this example is RuntimeBroker which we identified earlier. If the DCom Config tool lists two RuntimeBroker entries. To find the right one, right-click on an item and click Properties and match the App ID with the one in the registry.

• Select the Security tab.
• Under Launch and Activation Permissions, select Customize, and click Edit.

If the Edit button is grayed out in RuntimeBroker application Properties page in DCOM Config, you’ll need to verify the AppID registry key permissions.

• Under Group or user names, select Add.
• Enter the group or user name that’s recorded in the event log. For example, the account recorded in the log may be NT AUTHORITY\NETWORK SERVICE, NT AUTHORITY\SYSTEM, or some other group or account.
• Click OK.
• Assign Local Activation permission for that user or group you added, and complete the process.

This procedure prevents the event log errors Event ID: 10016 relating to DCOM permissions.

Note: Microsoft does not recommend the method of modifying the permissions on DCOM components to prevent this error from being logged because these errors do not adversely affect the functionality and modifying the permissions can have unintended side effects.

Hope this helps!

Related posts

• Pogreška ID-a događaja 158 - Dodjela identičnih GUID-ova diska u sustavu Windows 10

• Popravi pogrešku ID-a događaja 7031 ili 7034 kada se korisnik odjavi s računala sa sustavom Windows 10

• Kako popraviti pogrešku ESENT ID događaja 642 u sustavu Windows 11/10

• Popravite ID događaja Upravitelja kontrole usluge 7001 u sustavu Windows 11/10

• ID događaja 307 i 304 s kodom pogreške 0x801c001d na Windows 11/10

• Kako popraviti pogrešku Event ID 455 ESENT u sustavu Windows 11/10

• ID događaja 10006 i 1530: COM+ aplikacija ne radi u sustavu Windows 10

• ID događaja 1098: Pogreška 0xCAA5001C, operacija posrednika tokena nije uspjela

• ID događaja 219 kada je uređaj priključen; Učitavanje upravljačkog programa WUDFRD nije uspjelo

• Upravljački program je otkrio internu pogrešku upravljačkog programa na DeviceVBoxNetLwf

• Aplikacija ne može pronaći skener - WIA_ERROR_OFFLINE, 0x80210005

• Pogreška sustava 6118, Popis poslužitelja za ovu radnu grupu nije dostupan

• Pogreška usluge igranja 0x80073D26, 0x8007139F ili 0x00000001

• Popravak Pogreška učitavanja steamui.dll nije uspjela u sustavu Windows 11/10

• Ispravite pogrešku prijave u Microsoft Store 0x801901f4 u sustavu Windows 11/10

• MBR2GPT nije uspio omogućiti privilegije sigurnosnog kopiranja/vraćanja na Windows 10

• Popravite pogrešku učitavanja aplikacije 5:0000065434 u sustavu Windows 10

• Stub je primio poruku o grešci s lošim podacima u sustavu Windows 10

• Popravite pogrešku Logitech Setpoint Runtime u sustavu Windows 10

• Paket popravaka nije mogao biti registriran u sustavu Windows 11/10