Boostada maanta, waxaan ku aqoonsan doonaa sababta ka dibna waxaan bixin doonaa xalalka suurtagalka ah ee arrinta DCOM (DistributedCOM) Dhacdada ID 10016^{(DCOM (DistributedCOM) Event ID 10016)} qalad kaas oo laga yaabo inuu ka soo muuqdo daawadayaasha dhacdada Windows inta lagu jiro howlaha caadiga ah ee Windows 10 .

Qaabka  Shayga La Qaybiyay (DCOM)^{(Distributed Component Object Model (DCOM))} waa qayb ka mid ah xidhiidhka isku xidhan ee kombiyuutarada Windows . Waa tignoolajiyada Microsoft ee iska leh oo hir galisa mar kasta oo codsi uu sameeyo xidhiidh internet. COM-dhaqameedku wuxuu kaliya ka heli karaa macluumaadka isla mashiinka, halka DCOM ay ka heli karto xogta server-yada fog.

Tusaale ahaan, shabakado iyo adeegyo badan ayaa adeegsada qoraallo gelaya server fog. Marka nidaamkaagu sameeyo codsi isagoo isticmaalaya qoraal ama si kale, DCOM waxay codsiga u gudbisaa shayga qoraalka gaarka ah. Marka la eego inta jeer ee codsiyada casriga ah ay isticmaalaan isku xirka shabakada iyo isticmaalkeena guud ee kombiyuutarada, waxaad arki kartaa inta jeer ee DCOM loo isticmaalo.

Aqoonsiga Dhacdada DCOM 10016 khalad

Waxaad ogaan kartaa dhacdadan hoose ee 10016 oo soo gashay diiwaanka dhacdooyinka nidaamka kombiyuutarka ku shaqeeya Windows 10 , Windows Server 2016 , Windows Server 2019, Windows Server , nooca 1903 ama Windows Server 1909 :

Source: Microsoft-Windows-DistributedCOM
Event ID: 10016
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Caadi ahaan, waxaad la kulmi doontaa cilada sare ee la soo galiyay daawadayaasha dhacdada. Si kastaba ha noqotee, waxaa xusid mudan inay jiraan kala duwanaansho qaladka Aqoonsiga Dhacdada 10016 . ^{(Event ID 10016)}Si kastaba ha ahaatee^{(Nevertheless)} , habka lagu yareynayo qaladka asal ahaan waa isku mid.

Khaladka DCOM wuxuu badanaa dhacaa marka codsi ama adeeg uu isku dayo inuu isticmaalo DCOM laakiin aanu haysan ogolaanshaha saxda ah. Inta badan, khaladaadka DCOM ma saameeyaan nidaamkaaga, aan ka ahayn xidhidhiyahaaga Dhacdada^(Viewer) . Dhacdooyinkan 10016 waxa la diiwaan galiyay marka qaybaha Microsoft ay isku dayaan inay galaan qaybaha DCOM iyaga oo aan haysan ogolaanshaha loo baahan yahay. Xaaladdan oo kale, tan ayaa la filayaa iyo naqshadeynta.

Khaladaadka DCOM maahan wax laga werwero - si badbaado leh ayaad iskaga indho tiri kartaa. Si kastaba ha ahaatee, waxaa jira habab aad raaci karto si aad u xalliso qaladka aqoonsiga dhacdada 10016^{(ID 10016)} mar kasta oo ay dhacdo.

Sida loo xalliyo qaladka aqoonsiga dhacdada DCOM 10016^{(ID 10016)}

Si arrintan loo xalliyo, Microsoft waxay soo jeedinaysaa abuurista shaandhada XML si loo xakameeyo qaladka aqoonsiga dhacdada DCOM 10016^{(ID 10016)} .

Waa kan sida:

• Fur Event Viewer ( Riix furaha Windows^{(Press Windows)} + R. Run sanduuqa wada hadalka, ku qor Eventvwr oo ku dhufo Gelida).
• Riix Logs Windows^{(Windows Logs)} > System .
• Guji  shaandhaynta log hadda jirta ee ku ^{(Filter current log )} hoos jirta muraayadda Action .
• Dooro tab XML oo hubi su'aasha^{(Edit query manually)} wax ka beddel ikhtiyaarka gacanta.
• Nuqul ka samee oo ku dheji qoraalka XML soo socda ee wada hadalka filter.

<QueryList>
  <Query Id="0" Path="System">
    <Select Path="System">*</Select>
    <Suppress Path="System">
      *[System[(EventID=10016)]]
      and
      *[EventData[
        (
          Data[@Name='param4'] and Data='{D63B10C5-BB46-4990-A94F-E40B9D520160}' and
          Data[@Name='param5'] and Data='{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}' and
          Data[@Name='param8'] and Data='S-1-5-18'
        ) 
        or
        (
          Data[@Name='param4'] and Data='{260EB9DE-5CBE-4BFF-A99A-3710AF55BF1E}' and
          Data[@Name='param5'] and Data='{260EB9DE-5CBE-4BFF-A99A-3710AF55BF1E}'
        ) 
        or
        (
          Data[@Name='param4'] and Data='{C2F03A33-21F5-47FA-B4BB-156362A2F239}' and
          Data[@Name='param5'] and Data='{316CDED5-E4AE-4B15-9113-7055D84DCC97}' and
          Data[@Name='param8'] and Data='S-1-5-19'
        )
        or
        (
          Data[@Name='param4'] and Data='{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}' and
          Data[@Name='param5'] and Data='{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}' and
          Data[@Name='param8'] and Data='S-1-5-19'
        ) 
      ]]
    </Suppress>
  </Query>
</QueryList>

Su'aashan ,  param4  waxay u dhigantaa codsiga COM Server CLSID ,  param5  waxay u dhigantaa APPID,  param8  waxay u dhigantaa amniga macnaha SID , kuwaas oo dhammaantood lagu duubay diiwaanka dhacdooyinka 10016.

• Guji OK _

Gelida qaladka DCOM ee leh aqoonsiga dhacdada 10016^{(Event ID 10016)} hadda waa laga qariyey aragtida.

Haddii kale, waxaad xallin kartaa arrinta Ogolaanshaha DCOM adigoo isticmaalaya ^{(DCOM Permissions)}Tifaftiraha Diiwaangelinta^{(Registry Editor)} & Qalabka Config ee DCom^{(DCom Config)} .

Waa kan sida:

Hagaajintu waxay ku lug leedahay hagaajinta diiwaangelinta - markaa si taxaddar leh, waxaa lagugula talinayaa inaad dib u soo celiso diiwaanka^{(back up the registry)} ama aad sameyso barta soo celinta nidaamka .

Si looga hortago in dhacdooyinka la soo galiyo, raac tillaabooyinkan si aad oggollaansho u siiso qaybaha DCOM ee leh CLSID-yada gaarka ah iyo APPID ^(CLSIDs)-yada^(APPIDs) .

Marka hore, waxaad u baahan doontaa inaad ogaato habka ama adeega la xidhiidha aqoonsiga CLASS^{(CLASS ID)} ee ku taxan khaladka. Si tan loo sameeyo, horay u soco oo koobiyi CLSID^(CLSID) ku taxan sharaxaadda dhacdada. Xaaladdan oo kale, waa {D63B10C5-BB46-4990-A94F-E40B9D520160} . Hubi inaad koobiyayso labada tiir ee laablaaban sidoo kale.

Hadda, bilaw Tifaftiraha Diiwaangelinta . Markaad hesho tafatiraha diiwaanka la furay, dhagsii  Edit  ka dibna  Raadi^(Find) . Hore u soco oo ku dheji CLSID^(CLSID) sanduuqa raadinta oo ku dhufo Gelida^(Enter) .

Diiwaangelinta hadda waxay bilaabi doontaa raadinta. Muddo ka dib, waa in aad natiijada ka heshaa hoosta HK_CLASSES_ROOT\CLSID  furaha. Dhanka midigta, waa inay lahaataa laba fure oo midda  caadiga^(Default) ah waa inay taxdaa magaca adeegga. Xaaladdan oo kale, waa inay noqotaa RuntimeBroker .

Hadda oo aad aqoonsatay habka, waxaad hadda u sii wadi kartaa sida soo socota si aad u saxdo qaladka.

• Weli, gudaha tafatiraha diiwaanka, u gudub furaha AppID ee soo socda ee la xidhiidha RuntimeBroker:

HKEY_CLASSES_ROOT\AppID\{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}

Sida caadiga ah, TrustedInstaller ayaa^{(TrustedInstaller)} iska leh furaha diiwaangelinta iyo furayaasha hoose. U deji maamulaha^{(Set Administrator)} inuu yahay mulkiilaha furaha iyo furayaasha hoose. Fiiri  sida aad u yeelan karto lahaanshaha furayaasha diiwaanka^{(how to take ownership of registry keys)}  wixii macluumaad dheeraad ah.

• Ka dib markaad u dejiso maamulayaasha^{(Administrators)}  mulkiilaha, u  dir kooxda maamulayaasha^{(Administrators)}  iyo   koontada NIDAAMKA^(SYSTEM) waxay heystaan ​​ogolaansho buuxda oo ah furaha iyo furayaasha hoose.^{(Full Control)}
• Ka bax Tifaftiraha Diiwaanka

Marka xigta, billow qalabka isku xirka DCOM^{(DCOM Configuration)} (riix furaha Windows + R. In the Run box dialog, ku qor dcomcnfg.exe  oo ku dhufo Gelida.

• Guji Adeegyada Qaybaha^{(Component Services)} > Kombiyuutarrada > Kombuyuutarkayga^(Computers) > Koonfigga ^{(My Comput)}DCOM^{(DCOM Config)} .
• Midig ku dhufo^{(Right-click)} arjiga u dhigma AppID -ka ee lagu duubay diiwaanka dhacdada, ka dibna dooro Guryaha^(Properties) .

Magaca codsiga ee tusaalahan waa RuntimeBroker kaas oo aan horay u aqoonsannay. Haddii aaladda Config ee DCom^{(DCom Config)} ay liis gareyso laba RuntimeBroker gelis^{(RuntimeBroker)} . Si aad u hesho midda saxda ah, ku dhufo shay midigta oo guji Properties oo dhig aqoonsiga App^{(App ID)} -ka iyo kan ku jira diiwaanka.

• Dooro tab Amniga^(Security)
• Hoosta Oggolaanshaha Launch and Activation^{(Launch and Activation Permissions)} , dooro Customize , oo guji Edit .

Haddii badhanka Tafatirka uu ka baxo RuntimeBroker arjiga^(Edit) Guryaha ee^(Properties) DCOM Config^{(DCOM Config)} , waxaad u baahan doontaa inaad xaqiijiso oggolaanshaha furaha diiwaangelinta AppID .

• Hoosta kooxda ama magacyada isticmaale^{(Group or user names)} , dooro ku dar^(Add) .
• Geli^(Enter) kooxda ama magaca isticmaalaha ee ku diiwaan gashan diiwaanka dhacdada. Tusaale ahaan, koontada ku diiwaan gashan loggu waxa ay noqon kartaa NT AUTHORITY\NETWORK SERVICE , NT AUTHORITY\SYSTEM , ama koox kale ama akoon.
• Guji OK _
• U qoondee rukhsad firfircoonida maxaliga^{(Assign Local Activation)} ah isticmaale ama kooxda aad ku dartay, oo dhamaystir nidaamka.

Habkani waxa uu ka hortagayaa khaladaadka diiwaanka dhacdada aqoonsiga dhacdada^{(Event ID)} : 10016 ee la xidhiidha ogolaanshaha DCOM .

Fiiro gaar^(Note) ah : Microsoft kuma talinayso habka wax ka beddelka oggolaanshaha qaybaha DCOM si looga hortago in khaladkan la galo sababtoo ah khaladaadkani si xun uma saameeya shaqeynta iyo wax ka beddelka oggolaanshaha waxay yeelan kartaa saameyno aan loo baahnayn.

Hope this helps!

How to fix DCOM Event ID 10016 error on Windows 10

In today’s post, we will identify thе caυse and then provide the poѕsible solutions to the issue of DCOM (DistributedCOM) Event ID 10016 error that might show up in the Windows event viewer in the course of normal operations of Windows 10.

The Distributed Component Object Model (DCOM) is an integral aspect of networked communication on Windows computers. It is a proprietary Microsoft technology that whirs into action every time an application makes a connection to the internet. A traditional COM can only access information on the same machine, whereas DCOM can access data on remote servers.

For example, many websites and services use scripts that access a remote server. When your system makes a request using a script or otherwise, DCOM forwards the request to the specific script object. Given how frequently modern applications use a network connection and our general use of computers, you can see how frequently DCOM comes into use.

DCOM Event ID 10016 error

You may notice the below event 10016 logged in the system event logs on a computer that is running Windows 10, Windows Server 2016, Windows Server 2019, Windows Server, version 1903 or Windows Server 1909:

Source: Microsoft-Windows-DistributedCOM
Event ID: 10016
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Typically, you’ll encounter the above error logged in the event viewer. However, it’s noteworthy that there are variations of the Event ID 10016 error. Nevertheless, the procedure to mitigate the error is essentially the same.

A DCOM error usually occurs when an application or service attempts to use DCOM but does not have the proper permissions. Most of the time, DCOM errors won’t affect your system, other than clogging up your Event Viewer. These 10016 events are recorded when Microsoft components try to access DCOM components without the required permissions. In this case, this is expected and by design.

DCOM errors are nothing to worry about – you can safely ignore them. However, there are procedures you can follow to resolve the event ID 10016 error whenever it occurs.

How to resolve DCOM event ID 10016 error

To resolve this issue, Microsoft suggests creating an XML filter to suppress the DCOM event ID 10016 error.

Here’s how:

• Open Event Viewer (Press Windows key + R. In the Run dialog box, type eventvwr and hit Enter).
• Ckick Windows Logs > System.
• Click Filter current log under the Action pane.
• Select the XML tab and check Edit query manually option.
• Copy and paste the following XML text to the filter dialog.

<QueryList>
  <Query Id="0" Path="System">
    <Select Path="System">*</Select>
    <Suppress Path="System">
      *[System[(EventID=10016)]]
      and
      *[EventData[
        (
          Data[@Name='param4'] and Data='{D63B10C5-BB46-4990-A94F-E40B9D520160}' and
          Data[@Name='param5'] and Data='{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}' and
          Data[@Name='param8'] and Data='S-1-5-18'
        ) 
        or
        (
          Data[@Name='param4'] and Data='{260EB9DE-5CBE-4BFF-A99A-3710AF55BF1E}' and
          Data[@Name='param5'] and Data='{260EB9DE-5CBE-4BFF-A99A-3710AF55BF1E}'
        ) 
        or
        (
          Data[@Name='param4'] and Data='{C2F03A33-21F5-47FA-B4BB-156362A2F239}' and
          Data[@Name='param5'] and Data='{316CDED5-E4AE-4B15-9113-7055D84DCC97}' and
          Data[@Name='param8'] and Data='S-1-5-19'
        )
        or
        (
          Data[@Name='param4'] and Data='{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}' and
          Data[@Name='param5'] and Data='{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}' and
          Data[@Name='param8'] and Data='S-1-5-19'
        ) 
      ]]
    </Suppress>
  </Query>
</QueryList>

In this query, param4 corresponds to the COM Server application CLSID, param5 corresponds to the APPID, and param8 corresponds to the security context SID, all of which are recorded in the 10016 event logs.

• Click OK.

The DCOM error entries with the Event ID 10016 are now hidden from view.

Alternatively, you can fix DCOM Permissions issue using Registry Editor & DCom Config tool.

Here’s how:

The fix involves a registry tweak – so as a precautionary measure, it’s recommended that you back up the registry or create a system restore point.

To prevent the events from being logged, follow these steps to grant permission to the DCOM components that have specific CLSIDs and APPIDs.

First, you’ll need to figure out which process or service is associated with the CLASS ID listed in the error. To do this, go ahead and copy the CLSID listed in the event description. In this case, it is {D63B10C5-BB46-4990-A94F-E40B9D520160}. Make sure to copy both the curly braces also.

Now, launch Registry Editor. When you have the registry editor opened, click on Edit and then Find. Go ahead and paste the CLSID into the search box and hit Enter.

The registry will now initiate a search. After some time, you should get a result under the HK_CLASSES_ROOT\CLSID key. On the right-hand side, it should have two keys and the Default one should list out the name of the service. In this case, it should be RuntimeBroker.

Now that you have identified the process, you can now proceed as follows to fix the error.

• Still, in the registry editor, navigate to the following AppID key associated with the RuntimeBroker:

HKEY_CLASSES_ROOT\AppID\{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}

By default, TrustedInstaller owns this registry key and its subkeys. Set Administrator as the owner of the key and its subkeys. See how to take ownership of registry keys for more information.

• After setting Administrators as the owner, assign Administrators group and SYSTEM account have Full Control permission for the key and subkeys.
• Exit the Registry Editor.

Next, start the DCOM Configuration tool (press Windows key + R. In the Run dialog box, type dcomcnfg.exe and hit Enter.

• Click Component Services > Computers > My Computer > DCOM Config.
• Right-click the application that corresponds to the AppID that’s recorded in the event log, and then select Properties.

The application name in this example is RuntimeBroker which we identified earlier. If the DCom Config tool lists two RuntimeBroker entries. To find the right one, right-click on an item and click Properties and match the App ID with the one in the registry.

• Select the Security tab.
• Under Launch and Activation Permissions, select Customize, and click Edit.

If the Edit button is grayed out in RuntimeBroker application Properties page in DCOM Config, you’ll need to verify the AppID registry key permissions.

• Under Group or user names, select Add.
• Enter the group or user name that’s recorded in the event log. For example, the account recorded in the log may be NT AUTHORITY\NETWORK SERVICE, NT AUTHORITY\SYSTEM, or some other group or account.
• Click OK.
• Assign Local Activation permission for that user or group you added, and complete the process.

This procedure prevents the event log errors Event ID: 10016 relating to DCOM permissions.

Note: Microsoft does not recommend the method of modifying the permissions on DCOM components to prevent this error from being logged because these errors do not adversely affect the functionality and modifying the permissions can have unintended side effects.

Hope this helps!

Related posts

• Aqoonsiga Dhacdada 158 qalad - Diskiga isku midka ah ee GUIDs ee ku jira Windows 10

• Hagaaji aqoonsiga Event ID 7031 ama 7034 qalad marka isticmaaluhu uu baxo Windows 10 kumbuyuutarka

• Sida loo saxo Dhacdada ID 642 ESENT qaladka Windows 11/10

• Hagaaji dhacdada ID7001 Maareeyaha Xakamaynta Adeegga Windows 11/10

• Aqoonsiga dhacdada 307 iyo 304 oo leh kood qalad 0x801c001d Windows 11/10

• Aqoonsiga Dhacdada 1098: Cilad 0xCAA5001C, Hawlgalka dilaaliinta Token waa fashilmay

• Habkani waxa uu u baahan yahay warbaahin meesha laga saari karo - Qaladka dib u dejinta erayga sirta ah

• Hagaaji Qaladka Load Application 5:0000065434 Windows 10

• Hagaaji qaladka Codsiga 0xc0150004 gudaha Windows 11/10

• Hagaaji qaladaadka OOBEKEYBOARD, OOBELOCAL, OOBEREGION

• Khaladaadka 10016 ku hagaaji Windows Event Viewer

• Cilad 1327 Invalid Drive marka la rakibayo ama la furayo barnaamijyada

• Hagaajin waa ku guuldareystay in lagu shubo qaladka steamui.dll Windows 11/10

• Sida loo xaliyo dhibaatada isku dhaca Saxeexa Disk ee gudaha Windows 11/10

• Madax adag ayaa heshay fariin khaldan oo xog xun Windows 10

• Hagaaji Smart Check way dhaaftay, DST Gaaban Cilad ku fashilantay kombayutarka HP

• Hagaaji Bdeunlock.exe Sawirka Xun, Khaladka Nidaamka ama Aan ka jawaabin khaladaadka

• Hagaaji Aqoonsiga Dhacdada 14 iyo 17 - TPM amarka fashilka ee Windows 10

• Dejintu way awoodi wayday inay ku abuurto khalad qaybta qaybta cusub ee Windows 10

• Cilada adeegga ciyaaraha 0x80073D26, 0x8007139F ama 0x00000001