Question Windows 11 crashes associated with DistributedCOM Errors & Warnings - Event ID 10016

[ElMuchachoJumbo]

About a month ago my PC started having periodic crashes with BSODs, and sometimes it wouldn't even be able to reboot itself into Windows.

After taking it into my local tech shop a few times it seemed like the problem was solved by wiping it and reloading Windows 11. But after I reinstalled my programs it began to happen again. That's when I noticed these errors in eventvwr that always preceded the crashes:

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
and APPID
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
to the user Erik-PC\erik_ SID (S-1-5-21-1597121902-2507568645-2066462795-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Occasionally I would also see this:

After googling around I noticed that others have had this issue on Windows 10 (with the exact same CLSID and APPID in fact), though I had difficulty finding much info on Windows 11 systems. The APPID is associated with PerAppRuntimeBroker.

I followed the steps from this thread and this thread, but the issue still persists.

How can I further prevent these warnings/errors? Are these really the causes of crashes, or is it likely something else?

System specs:

Ryzen 7 5800X
RTX 3080 Ti
Gigabyte X570S AORUS Elite ATX AM4 Mobo
Ripjaws 32 GB DDR4
Maingear 850W PSU

 

[kerberos_20]

everybody has those warnings, its by design, you can ignore them
https://learn.microsoft.com/en-US/t...gement/event-10016-logged-when-accessing-dcom

 

[ElMuchachoJumbo]

everybody has those warnings, its by design, you can ignore them
https://learn.microsoft.com/en-US/t...gement/event-10016-logged-when-accessing-dcom

So they have nothing to do with the crashes?

 

[chronoschris]

My PC has also been suffering from weird completely random crashes(Not BSODS) but the type where you have to hard reset the entire PC because it wont let you shut down or restart from the start button. So I checked the Event Viewer and I'm also getting these weird DCOM errors 10016 and the 10010 one also. I'm also wondering if this is what is causing the crashes. I'm on Windows 11 which I just updated to recently but I was getting the same kind of crashes on Windows 10 also. I've just been kind of putting up with them for months, but it's getting annoying now.

 

[kerberos_20]

So they have nothing to do with the crashes?

nope, they are unrelated

you could upload some minidumps if you have BSOD errors, that could maybe tell why its crashing

 

[kerberos_20]

My PC has also been suffering from weird completely random crashes(Not BSODS) but the type where you have to hard reset the entire PC because it wont let you shut down or restart from the start button. So I checked the Event Viewer and I'm also getting these weird DCOM errors 10016 and the 10010 one also. I'm also wondering if this is what is causing the crashes. I'm on Windows 11 which I just updated to recently but I was getting the same kind of crashes on Windows 10 also. I've just been kind of putting up with them for months, but it's getting annoying now.

DCOM permissions or timeouts will not crash your PC, if you have issue, please start another thread

 

[yoMuzicMan]

I have the same issue with a new Dell 7620 (only 2 months old). Random hangs which last for several seconds or require a hard reset of the computer. BSODs or screens go black for a second and then come back on. When any of these 3 issues occur event 10016, and sometimes only this event, is logged. It certainly seems they are related. I don't see a reason to start a new thread as the title of this one seems relevant.

Log Name: System
Source: Microsoft-Windows-DistributedCOM
Date: 2/25/2023 4:35:17 PM
Event ID: 10016
Task Category: None
Level: Warning
Keywords: Classic
User: DESKTOP-6BN26SG\yoron
Computer: DESKTOP-6BN26SG
Description:
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
and APPID
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
to the user DESKTOP-6BN26SG\yoron SID (S-1-5-21-1455323201-3139584213-1127209901-1001) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.ContentDeliveryManager_10.0.22621.1_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723). This security permission can be modified using the Component Services administrative tool.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
<EventID Qualifiers="0">10016</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2023-02-25T23:35:17.9996232Z" />
<EventRecordID>174080</EventRecordID>
<Correlation ActivityID="{7bb26d1c-496b-0008-c215-b37b6b49d901}" />
<Execution ProcessID="1664" ThreadID="3948" />
<Channel>System</Channel>
<Computer>DESKTOP-6BN26SG</Computer>
<Security UserID="S-1-5-21-1455323201-3139584213-1127209901-1001" />
</System>
<EventData>
<Data Name="param1">machine-default</Data>
<Data Name="param2">Local</Data>
<Data Name="param3">Activation</Data>
<Data Name="param4">{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}</Data>
<Data Name="param5">{15C20B67-12E7-4BB6-92BB-7AFF07997402}</Data>
<Data Name="param6">DESKTOP-6BN26SG</Data>
<Data Name="param7">yoron</Data>
<Data Name="param8">S-1-5-21-1455323201-3139584213-1127209901-1001</Data>
<Data Name="param9">LocalHost (Using LRPC)</Data>
<Data Name="param10">Microsoft.Windows.ContentDeliveryManager_10.0.22621.1_neutral_neutral_cw5n1h2txyewy</Data>
<Data Name="param11">S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723</Data>
</EventData>
</Event>


I've followed the instructions from the link below, but still have the issues:

https://answers.microsoft.com/en-us...ent ID 10016 means,how to modify the registry

Anyone else have the same situation and a workaround or fix?

Thanks!
I've already tried to fix permissions on both keys in the registry. An

 

[kerberos_20]

I have the same issue with a new Dell 7620 (only 2 months old). Random hangs which last for several seconds or require a hard reset of the computer. BSODs or screens go black for a second and then come back on. When any of these 3 issues occur event 10016, and sometimes only this event, is logged. It certainly seems they are related. I don't see a reason to start a new thread as the title of this one seems relevant.

Log Name: System
Source: Microsoft-Windows-DistributedCOM
Date: 2/25/2023 4:35:17 PM
Event ID: 10016
Task Category: None
Level: Warning
Keywords: Classic
User: DESKTOP-6BN26SG\yoron
Computer: DESKTOP-6BN26SG
Description:
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
and APPID
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
to the user DESKTOP-6BN26SG\yoron SID (S-1-5-21-1455323201-3139584213-1127209901-1001) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.ContentDeliveryManager_10.0.22621.1_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723). This security permission can be modified using the Component Services administrative tool.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
<EventID Qualifiers="0">10016</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2023-02-25T23:35:17.9996232Z" />
<EventRecordID>174080</EventRecordID>
<Correlation ActivityID="{7bb26d1c-496b-0008-c215-b37b6b49d901}" />
<Execution ProcessID="1664" ThreadID="3948" />
<Channel>System</Channel>
<Computer>DESKTOP-6BN26SG</Computer>
<Security UserID="S-1-5-21-1455323201-3139584213-1127209901-1001" />
</System>
<EventData>
<Data Name="param1">machine-default</Data>
<Data Name="param2">Local</Data>
<Data Name="param3">Activation</Data>
<Data Name="param4">{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}</Data>
<Data Name="param5">{15C20B67-12E7-4BB6-92BB-7AFF07997402}</Data>
<Data Name="param6">DESKTOP-6BN26SG</Data>
<Data Name="param7">yoron</Data>
<Data Name="param8">S-1-5-21-1455323201-3139584213-1127209901-1001</Data>
<Data Name="param9">LocalHost (Using LRPC)</Data>
<Data Name="param10">Microsoft.Windows.ContentDeliveryManager_10.0.22621.1_neutral_neutral_cw5n1h2txyewy</Data>
<Data Name="param11">S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723</Data>
</EventData>
</Event>


I've followed the instructions from the link below, but still have the issues:

https://answers.microsoft.com/en-us/windows/forum/all/persistent-pc-freeze-and-crash-with-dcom-10016/2ce32a8f-d94e-45ce-88a5-a139f85ca75e#:~:text=DCOM event ID 10016 means,how to modify the registry

Anyone else have the same situation and a workaround or fix?

Thanks!
I've already tried to fix permissions on both keys in the registry. An

The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
and APPID
{15C20B67-12E7-4BB6-92BB-7AFF07997402}

you can search in registry which app is it by that clsid and appid, permissions add inside win registry

 

[johnbl]

About a month ago my PC started having periodic crashes with BSODs, and sometimes it wouldn't even be able to reboot itself into Windows.

After taking it into my local tech shop a few times it seemed like the problem was solved by wiping it and reloading Windows 11. But after I reinstalled my programs it began to happen again. That's when I noticed these errors in eventvwr that always preceded the crashes:

Occasionally I would also see this:

After googling around I noticed that others have had this issue on Windows 10 (with the exact same CLSID and APPID in fact), though I had difficulty finding much info on Windows 11 systems. The APPID is associated with PerAppRuntimeBroker.

I followed the steps from this thread and this thread, but the issue still persists.

How can I further prevent these warnings/errors? Are these really the causes of crashes, or is it likely something else?

System specs:

Ryzen 7 5800X
RTX 3080 Ti
Gigabyte X570S AORUS Elite ATX AM4 Mobo
Ripjaws 32 GB DDR4
Maingear 850W PSU

you can make changes to fix the error from being reported:
https://www.kapilarya.com/fix-event...ant-local-activation-permission-in-windows-10

I would not bother, It seems to be a bogus error with no effect, also you can go thru the fix then get later a system update wipes it out and you get the log entries again.
I would expect the issue is due to the interface using a loopback address via the network.
where a loopback address means to use a windows socket that points to the local machine.
IE use a network socket to use the network but only access the same machine. it should be allowed since it would still work if the network is unconnected.
loopback address = 127.0.0.1
What is a Loopback Address? - GeeksforGeeks

I just ignore the error, microsoft should fix it so people stop seeing the bogus unhelpful error.
maybe list it as a warning.
It is unrelated to a machine crash.

you should focus on the minidump