Event ID 10016 - DistributedCOM

How to resolve this error recorded in System log of Event Viewer

  1. Regedit32

    Regedit32 Moderator

    Joined:
    Mar 4, 2016
    Messages:
    2,614
    Likes Received:
    763
    Regedit32 submitted a new article:

    Event ID 10016 - DistributedCOM - How to resolve this error recorded in System log of Event Viewer

    Read more about this article...
     
    Regedit32, Sep 6, 2016
    #1
    1. Advertisements

  2. Regedit32

    Trouble Noob Whisperer Moderator

    Joined:
    Nov 19, 2013
    Messages:
    10,394
    Likes Received:
    1,557
    Location:
    Northwest Indiana U.S.A.
    Followed the article step by step..... easy as pie.
    Thanks for the very helpful and concise information.
    Much appreciated.
     
    Trouble, Sep 8, 2016
    #2
    1. Advertisements

  3. Regedit32

    Regedit32 Moderator

    Joined:
    Mar 4, 2016
    Messages:
    2,614
    Likes Received:
    763
    Thanks Trouble.

    I've just edited the article as I noticed I did make one small mistake when I mentioned click View > List.

    While that is fine, I actually meant to say View > Detail as this provides not only the list of DistributedCOM components but also a second column which shows their AppID too.
     
    Regedit32, Sep 8, 2016
    #3
  4. Regedit32

    Trouble Noob Whisperer Moderator

    Joined:
    Nov 19, 2013
    Messages:
    10,394
    Likes Received:
    1,557
    Location:
    Northwest Indiana U.S.A.
    I either ....
    Didn't notice, figured it out on my own or actually performed the task after your edit.
    In either case, it worked as advertised so..... I'm happy.
     
    Trouble, Sep 8, 2016
    #4
  5. Regedit32

    Majestic12

    Joined:
    Sep 18, 2016
    Messages:
    7
    Likes Received:
    0
    Location:
    Poland
    I did everything as in this article and now when I click for example the "Playback devices" on the taskbar's volume icon, UAC shows up (rundll32). How can this be repaired?
     
    Majestic12, Sep 18, 2016
    #5
  6. Regedit32

    Regedit32 Moderator

    Joined:
    Mar 4, 2016
    Messages:
    2,614
    Likes Received:
    763
    Hi Majestic,

    Welcome to the Forum.

    If you mean you are receiving an error message that reads 'Windows cannot access the specified device, path or file. You may not have appropriate permissions to access the item.' and this is pointing to C:\WINDOWS\System32\rundll32.exe then can you please do the following and report back your result.
    • Right-click on Start
    • Left-click on Command Prompt
    • In the Command Prompt window type or copy & paste the following command:

      Code (Text):
      reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA
      Press Enter key to execute

      Sample Image

      Untitled.png

      Please let me know your result: Above sample shows result is 0x1

    If you mean something else then please clearly state what error message you are seeing.

    Also, can you tell me which CLSID and AppID you modified permissions on and which DistributedCOM you modified and what modification you made precisely.

    Regards,

    Regedit32
     
    Regedit32, Sep 18, 2016
    #6
  7. Regedit32

    Majestic12

    Joined:
    Sep 18, 2016
    Messages:
    7
    Likes Received:
    0
    Location:
    Poland
    Hi Regedit32, thanks for the welcome :D

    I meant an UAC (User Account Control) confirmation that shows up when you run an app with admin privileges. It looks like this (I can access the soundcard options but it's annoying):

    screenshot.png

    I modified the same CLSID and AppID as in the article and restored permissions in the end. This problem started even before rebooting or restarting services and it's still there after reboot.
     
    Majestic12, Sep 18, 2016
    #7
  8. Regedit32

    Regedit32 Moderator

    Joined:
    Mar 4, 2016
    Messages:
    2,614
    Likes Received:
    763
    Hi again,

    The DistributedCOM you modified along with its associated CLSID and AppID has nothing to do with the User Account Control alerts, so it is entirely coincidental that after doing this you are seeing this alert when attempting to run Applications with Administrator privileges.

    If you do not wish to see this alert you need to adjust the User Account Control Settings:
    • Right-click on Start
    • Left-click on Control Panel
    • When the Control Panel opens in the upper right region of window make sure View by: Category is selected.
    • Left-click System and Security
    • Left-click Change User Account Control settings (located at top of window)

      This will open a new window with a slider. Adjust down to the level you wish to stop that alert appearing.

    Regards,

    Regedit32
     
    Regedit32, Sep 18, 2016
    #8
  9. Regedit32

    Majestic12

    Joined:
    Sep 18, 2016
    Messages:
    7
    Likes Received:
    0
    Location:
    Poland
    That's not it because I have the default UAC level. I think that even with the highest UAC level rundll32.exe doesn't show an UAC window. I noticed that I get this prompt also when accessing mouse, keyboard and few more settings in control panel.
    There's something interesting about this file in the system32 folder. It has that little UAC icon (so it opens with the UAC prompt) and every other Win 10 PC I have shows the normal icon (there is no UAC prompt when I open it). Even after deleting the file and copying it directly from the another PC (retaining its permissions etc.), the rundll32 suddenly has this UAC icon...The same file in the backup WinSxS folder can be opened without UAC but when it's copied to the system32 it changes immediately. It looks like rundll32.exe file in system32 folder doesn't have the flag "run as admin without the need for UAC elevation prompt" anymore. Because of the security reasons we don't know how this flags or something else works so I think it's difficult problem to solve...
     
    Majestic12, Sep 19, 2016
    #9
  10. Regedit32

    Regedit32 Moderator

    Joined:
    Mar 4, 2016
    Messages:
    2,614
    Likes Received:
    763
    Well there is a rundll32.exe virus out there in the great wide world of internetting.

    Perhaps you ought to press windows key and R then enter MRT into the run dialog and click OK then run a full scan
     
    Regedit32, Sep 19, 2016
    #10
  11. Regedit32

    Majestic12

    Joined:
    Sep 18, 2016
    Messages:
    7
    Likes Received:
    0
    Location:
    Poland
    It didn't find anything. I'll wait for the next Windows update, maybe it will fix the rundll32 file. Ironically, now I have much more ID 10016 errors in the Event Viewer because apps can't access the rundll32 file :D
     
    Majestic12, Sep 21, 2016
    #11
  12. Regedit32

    Regedit32 Moderator

    Joined:
    Mar 4, 2016
    Messages:
    2,614
    Likes Received:
    763
    When you modified your DistributedCOM was it one of the two Rundll32.3xe components?

    I'm sure you said you just modified the same one as in my article but just in case I better ask as it would be relatively easy to reset permissions on either of the Rundll32.exe DistributedCOM components.
     
    Regedit32, Sep 21, 2016
    #12
  13. Regedit32

    Majestic12

    Joined:
    Sep 18, 2016
    Messages:
    7
    Likes Received:
    0
    Location:
    Poland
    Sorry I meant the ID 10001 errors like this:
    As I said I didn't modify anything related to the rundll32.exe but I noticed something in the Event Viewer just because of your post :D The error I quoted above started appearing on 14th September and the only thing that was installed that day was the windows cumulative update (KB3189866) and some other Office updates. So this problem may be connected with the Windows update, not this article. I just haven't used the Control Panel or sound settings for a few days.

    So can my problem be solved based of the error I posted?
     
    Majestic12, Sep 22, 2016
    #13
  14. Regedit32

    Regedit32 Moderator

    Joined:
    Mar 4, 2016
    Messages:
    2,614
    Likes Received:
    763
    That's your Sync Integration Manager which is part of the Local Server.

    I would not recommend messing with that via DistributedCOM, but it would be worth running a Windows Update Troubleshooter, and possibly a System File Check [ SFC /SCANNOW ] via Administrator: Command Prompt.

    You'll find the Windows Update troubleshoot tool here:

    Control Panel\All Control Panel Items\Troubleshooting\All Categories

    Or just type troubleshooting into the Search box, press Enter key then in left pane select View all
     
    Regedit32, Sep 22, 2016
    #14
  15. Regedit32

    PoonCha

    Joined:
    Sep 24, 2016
    Messages:
    1
    Likes Received:
    0
    I prefer to make the changes via RE. Please post instructions, as you offered.

    Thanks

    "Note:
    If you'd prefer to manually take ownership via the Registry Editor, but are not sure how, just ask in the Discussion section of this article and I'll post instructions on how to do this."
     
    PoonCha, Sep 24, 2016
    #15
  16. Regedit32

    Regedit32 Moderator

    Joined:
    Mar 4, 2016
    Messages:
    2,614
    Likes Received:
    763
    Hi PoonCha,

    Welcome to the Forum.

    I'll use the CLSID and AppID mentioned in article to demonstrate how to take ownership using the Registry Editor.
    • Right-click on Start
    • Left-click on Run
    • When the User Account Control appears click Yes
    • The Registry Editor window will now open.

      In the left pane click and expand to this location:
    HKEY_CLASSES_ROOT
    — CLSID
    {8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
    • In left pane you need to right-click on the key {8D8F4F83-3594-4F07-8369-FC3C3CAE4919} and select Permissions

      This will open the following window:

      Untitled.png

      Click the Advanced button which will take you to the following window:

      Untitled2.png

      On this window you see the Owner is currently SYSTEM

      Click the hyperlinked Change to the right of SYSTEM which will open this window:

      Untitled3.png

      Type Administrators into the empty field, then click Check Names button.

      A username belonging to the Administrators Group will appear. Click OK

      Sample Images

      Untitled4.png

      This will return you to previous window, where you see the Owner has changed. Just beneath the Owner will be an empty box. Check this box and click OK

      Sample Image

      Untitled5.png

      This brings you back to the original window:

      Untitled6.png

      Click OK

      Ownership of this CLSID key {8D8F4F83-3594-4F07-8369-FC3C3CAE4919} is now changed.

    • The AppID
      {F72671A9-012C-4725-9D2F-2A4D32D65169}
      was the other entry in article we wanted to take ownership of. To find it in the left pane of Regeistry Editor we expand the keys to this location:

    HKEY_LOCAL_MACHINE
    — SOFTWARE
    — Classes
    — AppID
    {F72671A9-012C-4725-9D2F-2A4D32D65169}
    • Now simple repeat the previous steps to take ownership of this key.

    Later if you wish to change the ownership back to original owner then in this window:

    Untitled3.png

    If the original owner was SYSTEM then simply type system into the empty field and click Check Names, then click OK. Then click OK on the next window, and click OK on the next.

    If the original owner was TrustedInstaller then simply type nt authority\TrustedInstaller and click Check Names, then click OK. Then click OK on next window, and click OK on the next.

    Regards,

    Regedit32






     
    Regedit32, Sep 25, 2016
    #16
  17. Regedit32

    Musicman78

    Joined:
    Oct 13, 2016
    Messages:
    6
    Likes Received:
    0
    Hi there,
    first of all: thanks for your effort. This is a nice and detailed Discription.
    I´m fighting against that Distributed COM Error quite a few days and i´m not managed to fix it yet.
    The System is running very instable and i have a crash during games everytime the error Message appears in the windows logfile.
    I tried to go along your discription, but when it comes to the 4th command line, i get an error Message and i cant go on to step 4 and change the distributetcom component. I tried to take ownership of the 2 reg entries via the regedit (mentioned somewhere above in the discussion), but it wont help either.
    Any Ideas left?
    P.S. the AppID and CLSID are exactly the same (my eventlog error message and your axample)
    Thanks in advance.

    upload_2016-10-13_22-47-29.png
     
    Musicman78, Oct 13, 2016
    #17
  18. Regedit32

    Regedit32 Moderator

    Joined:
    Mar 4, 2016
    Messages:
    2,614
    Likes Received:
    763
    Hi Musicman78,

    Welcome to the Forum.

    If access is denied this suggests the object's original owner has restricted all inherited ACE's and set an ACL which restricts access even to the Administrators.

    Are you the only user on this computer? Or does someone else have Administrative access too?

    Regedit32
     
    Regedit32, Oct 14, 2016
    #18
  19. Regedit32

    Musicman78

    Joined:
    Oct 13, 2016
    Messages:
    6
    Likes Received:
    0
    I'm the only user on my pc
     
    Musicman78, Oct 14, 2016
    #19
  20. Regedit32

    Regedit32 Moderator

    Joined:
    Mar 4, 2016
    Messages:
    2,614
    Likes Received:
    763
    Does your log in username belong to the Administrative group?
     
    Regedit32, Oct 14, 2016
    #20
    1. Advertisements

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.
Similar Threads
  1. Sjoerd Gehrels

    DistributedCOM 10016

    Sjoerd Gehrels, Dec 29, 2015, in forum: Windows 10 Support
    Replies:
    0
    Views:
    1,972
    Sjoerd Gehrels
    Dec 29, 2015
  2. dac8190

    SOLVED Event ID 10016 Locks computer at start up

    dac8190, Aug 27, 2016, in forum: Windows 10 Support
    Replies:
    14
    Views:
    4,169
    dac8190
    Jun 20, 2017
  3. MitjaHD

    Kernel-Power Event ID 41

    MitjaHD, Dec 12, 2016, in forum: Crashes, BSODs and Debugging
    Replies:
    1
    Views:
    701
  4. Poromaster

    Event ID 10016 - DistributedCOM

    Poromaster, Dec 24, 2016, in forum: Crashes, BSODs and Debugging
    Replies:
    0
    Views:
    590
    Poromaster
    Dec 24, 2016
  5. Bob53

    SOLVED Event id 10016 Runtime Broker

    Bob53, Mar 7, 2017, in forum: Windows 10 Support
    Replies:
    4
    Views:
    1,468
    Bob53
    Mar 8, 2017
  6. Bob53

    Event id 41 (63) BSOD WD failure.

    Bob53, Mar 14, 2017, in forum: Windows 10 Support
    Replies:
    25
    Views:
    710
    Bob53
    Mar 17, 2017
  7. Yahnny

    Event Error ID 63, for application not running

    Yahnny, Apr 13, 2017, in forum: Windows 10 Support
    Replies:
    1
    Views:
    333
    Regedit32
    Apr 14, 2017
  8. gollux

    SOLVED Errors in Event Viewer: EapHost, Event ID 2002

    gollux, Jun 4, 2017, in forum: Windows 10 Support
    Replies:
    4
    Views:
    630
    gollux
    Jun 14, 2017
Loading...