Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Question
Wednesday, May 31, 2017 3:12 AM | 1 vote
This question is identical to the one on this linked page for Windows 8.1 Pro 32bit dated Wednesday, March 11, 2015 9:08 PM
Why does this issue still exist 2 years later for Windows 10 Pro 64bit?
With the following details for Windows 10 Pro
Log Name: System
Source: Microsoft-Windows-DistributedCOM
Date: 5/30/2017 9:56:00 PM
Event ID: 10016
Task Category: None
Level: Error
Keywords: Classic
User: LOCAL SERVICE
Computer: Sanctuary2
Description:
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
<EventID Qualifiers="0">10016</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2017-05-31T01:56:00.903788600Z" />
<EventRecordID>2066</EventRecordID>
<Correlation />
<Execution ProcessID="620" ThreadID="9288" />
<Channel>System</Channel>
<Computer>Sanctuary2</Computer>
<Security UserID="S-1-5-19" />
</System>
<EventData>
<Data Name="param1">application-specific</Data>
<Data Name="param2">Local</Data>
<Data Name="param3">Activation</Data>
<Data Name="param4">{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}</Data>
<Data Name="param5">{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}</Data>
<Data Name="param6">NT AUTHORITY</Data>
<Data Name="param7">LOCAL SERVICE</Data>
<Data Name="param8">S-1-5-19</Data>
<Data Name="param9">LocalHost (Using LRPC)</Data>
<Data Name="param10">Unavailable</Data>
<Data Name="param11">Unavailable</Data>
</EventData>
</Event>
Using dcomcnfg, no entries exist there for either CLSID or APPID!
Using regedit CLSID & APPID point to ShellServiceHost, with additional parameter for APPID {4839DDB7-58C2-48F5-8283-E1D1807D0D7D} of 'RunAs" as Interactive User
So, what is the purpose of this? And why would it still exist in a New Machine? I have 20 of them in the last 7 days. Could we for once get new hardware, with a new OS, and have "ZERO" errors built into the machine?
Is this related to
"Consider the lilies of the field, how they grow; they toil not, neither do they spin: yet I say unto you, that even Solomon in all his glory was not arrayed like one of these. Be not therefore anxious, saying, What shall we do about this error? What shall we think? How will we fix? For their creator Microsoft knoweth that ye have need of all these things"
Say what?
Chip Cooper
All replies (4)
Thursday, June 1, 2017 2:26 AM ✅Answered
Hi Cyberchipz,
In reality this particular event is quite common and has from time to time been logged on most users computers running a Windows OS regardless of version they have.
Generally, Windows manages quite well and this error is nothing too much to concern oneself with, however, for those running a Server or Network Service this error if left unresolved can become troublesome.
Within the error message Microsoft informs the user we can manually adjust some settings to resolve issue and this would be fine but for a few issues that your average punter would not know how to get around.
Please Note: Since the website is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.
Hope it will be helpful to you
Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].
Tuesday, June 6, 2017 3:33 PM
I would love to have had this be a solution, unfortunately Step 18 requires using dcomcnfg and as I said above, just below the paste of the error "Using dcomcnfg, no entries exist there for either CLSID or APPID!"
This is not my first rodeo on errors like this, this one is unique in many ways. Both the CLSID and APPID point to ShellServiceHost, with naturally the APP side requesting RunAs interactive user.
You'd be right in saying I don't completely understand this, as it appears to be some kind of circular reference. That's the level of my ignorance. IOW. ShellServiceHost is calling ShellServiceHost with RunAs Interactive User.
I have no clue as to why the CLSID and APPID don't show up in dcomcnfg at all?! This too is puzzling. I was thinking perhaps so I could access the Shell to list services, or make queries, but I seem to be able to do that anyway, using Sysinternals' tools. With all the errors, and there is lots of them, something is going on. The amount of repeats appears like a circular call and I'm not sure what ends the cycle if not some kind of timeout. I keep thinking I might be able to trap this with the Process Monitor somehow, but many processes use ShellServiceHost that might be troublesome.
So basically... what is going on, and why don't those ID's exist in dcomcnfg? I'm loathe to give anything local permissions without knowing what it is, and that's what the process in the link you supplied does. I don't blame you for saying, "Microsoft does not guarantee the accuracy of this information.", I wouldn't put my name on this either. Messing with DCOM permissions makes me nervous. This isn't like other DCOM 10016 errors as I said, the CLSID and APPID are not listed in Component Services. I hope this is clearer. What's the point of the system complaining about errors if Microsoft thinks there of no significance, and why do they exist as an OOBE? What am I missing here?
The examples below are not specific to this error; but, they do indicate that number of people having OOBE with DCOM errors and how far back this goes. I have I think a good instinct on what ShellServiceHost does. Not to be facetious, It's a shell that acts as a host to a ton of services. I would think that one of it's functions is to ensure the integrity of security for the system. Plus, from confirming what RunAs Interactive User... "The user-name and password are then used to create a logon session in which the server is run. When launched in this way, the user runs with its own desktop and window station and does not share window-handles, the clipboard, or other UI elements with the interactive user or other user running in other user accounts."
Sounds like spooky action at a distance to anyone who gains local permissions.
[Tons of Shell Service Host errors on the web!]( "The ubiquity of this error out of the box!")
Some information showing Historical instances of OOBE with users trying to understand the problem.
I'm more than a 'user', when there's sufficient information, I'm an OEM, Network Analyst, Policy Manager, and overall IT... and add Programmer and Software developer in my day!
DistributedCOM Errors Flooding Event Log - Microsoft Community
<cite class="_Rm" style="color:#006621;font-style:normal;font-size:14px;">https://answers.microsoft.com/en.../22701266-e81e-40a5-9fb4-780519363f59</cite>
1.
Aug 12, 2015 - I found the Appid in the DCOM Config via Component Services and It appears to be tied to "ShellServiceHost" any idea how I can keep this ...
Issues with Windows 10 and getting "Shell Experience Host loop ...
Dec 2, 2016
DistributedCOM Errors Filling my Event Log
Mar 20, 2016
Error - Event ID: 10016; DistributedCOM
Oct 20, 2013
DCOM Error 10016 - Cannot change permissions in Component ...
Aug 24, 2009
More results from answers.microsoft.com
Chip Cooper
Wednesday, June 7, 2017 8:39 AM | 1 vote
Hi，
Did you get your Windows 10 via Upgrade process?
Please know that this issue could be caused if the TrustedInstaller from a previous application and the RunTime Broker did not give System and Local Administrators permission during a Windows upgrade.
Based on my experience, this issue happens in some older builder when Windows 10 just released. Please try the steps Carl provided to fix the permission issue.
BTW, I would like to confirm with you, did you mean to not find the Shellservicehost in dcomcnfg? It wasn't list as Appid or CLSID, but the name appear as below: Would you please recheck this?
Also, we can find the registry key as below:
HKEY_CLASSES_ROOT\AppID\4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
HKEY_CLASSES_ROOT\CLSID\6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
Make sure to take owner of these registry keys and manually configure the access permission for this components:
Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].
Wednesday, June 7, 2017 3:23 PM
I just bought this as a new build, if it is Windows 10 via upgrade path, there might be something hokey going on unless I'm mistaken in that the Windows 10 upgrade path is now closed. If this the case, before I make an inquiry to the OEM, is there a way to tell if I'm on the upgrade path rather than a current OEM Win 10 Pro license?
You have a point, the listing for the APPID ShellServiceHost is indeed listed in dcomcnfg as you indicate.
And I also found this listed as an common error in the Windows 10 Anniversary Upgrade path. In fact, not only have you commented on this issue, probably many times; but, I have handled it. o.O
I'm going to stop trying to troubleshoot on sleepless nights, as apparently my heads not working properly anymore @ 3:12AM! Truth is, somehow I got the CLSID & APPID flipped, thinking the APPID was the CLSID, thus the confusion on the RunAs Interactive. Since this was a new build, I also didn't expect it to have the DCOM problems associated with the Anniversary Upgrade path, all of which I've cleared on my other, older machine.
It's sad, as I think on this that @ 62yrs of age, this isn't the first sign my troubleshooting skills are waning. :'( certainly at least when I'm tired. So, yes, this is a known problem and a duplicate. defaultuser0, bad SID, DCOM errors, yep, they're all there even though they shouldn't be... I really wish I didn't have to clean all of this up! Ironically, I remember a post where someone said, Microsoft is going to fix all this in newer updates. At least defaultuser0 appears to be gone, or I can't find it.
Chip Cooper