Windows Event ID 10016 – Microsoft-Windows-DistributedCOM: DCOM Permission Denied Error

Start by examining the specific CLSID and APPID mentioned in the event to determine if action is required.

1. Open Event Viewer → Windows Logs → System
2. Filter for Event ID 10016 using PowerShell:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=10016} -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

3. Note the CLSID and APPID from the event description
4. Check if the CLSID corresponds to known Microsoft components:

# Common Microsoft CLSIDs that generate benign 10016 events
$BenignCLSIDs = @(
    '{D63B10C5-BB46-4990-A94F-E40B9D520160}', # Windows Search
    '{260EB9DE-5CBE-4BFF-A99A-3710AF55BF1E}', # Shell Experience Host
    '{C2F03A33-21F5-47FA-B4BB-156362A2F239}', # Windows Security Health
    '{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}'  # Cortana
)

# Check if your CLSID is in the benign list
$YourCLSID = '{PASTE-YOUR-CLSID-HERE}'
if ($BenignCLSIDs -contains $YourCLSID) {
    Write-Host "This CLSID is known to generate benign 10016 events" -ForegroundColor Green
} else {
    Write-Host "This CLSID may require investigation" -ForegroundColor Yellow
}

Modify DCOM security settings to grant appropriate permissions to the requesting user or service.

1. Press Win + R, type dcomcnfg.exe, and press Enter
2. Navigate to Component Services → Computers → My Computer → DCOM Config
3. Locate the application using the APPID from the event (search by GUID)
4. Right-click the application → Properties → Security tab
5. Under Launch and Activation Permissions, click Edit
6. Add the user or service account mentioned in the event:

# To find the username from SID in the event
$SID = 'S-1-5-18'  # Replace with SID from your event
$User = (New-Object System.Security.Principal.SecurityIdentifier($SID)).Translate([System.Security.Principal.NTAccount])
Write-Host "SID $SID corresponds to: $($User.Value)"

7. Grant Local Launch and Local Activation permissions
8. Click OK and restart the affected service or reboot

For confirmed benign events from Microsoft components, you can suppress logging to reduce event log noise.

1. Identify the specific DCOM component generating benign events
2. Create a registry backup before making changes:

# Backup DCOM registry settings
reg export "HKLM\SOFTWARE\Classes\AppID" "C:\Temp\DCOM_AppID_Backup.reg" /y
reg export "HKLM\SOFTWARE\Microsoft\Ole" "C:\Temp\DCOM_Ole_Backup.reg" /y

3. Navigate to the DCOM application's registry key:

# Find DCOM application registry path
$APPID = '{YOUR-APPID-HERE}'  # Replace with APPID from event
$RegPath = "HKLM:\SOFTWARE\Classes\AppID\$APPID"
if (Test-Path $RegPath) {
    Get-ItemProperty -Path $RegPath
} else {
    Write-Host "APPID not found in registry" -ForegroundColor Red
}

4. For Microsoft components only, you can disable DCOM logging by modifying the EnableDCOMHTTP value
5. Alternative approach - filter events at the Event Log level:

# Create custom event log view to exclude benign 10016 events
$FilterXML = @'

  
    
      *[System[Provider[@Name='Microsoft-Windows-DistributedCOM'] and EventID=10016]]
      and
      *[EventData[Data[@Name='param1'] != '{D63B10C5-BB46-4990-A94F-E40B9D520160}']]
    
  

'@

Get-WinEvent -FilterXml $FilterXML -MaxEvents 10

For non-Microsoft applications generating 10016 events, perform detailed investigation and resolution.

1. Identify the application associated with the CLSID:

# Query registry for CLSID information
$CLSID = '{YOUR-CLSID-HERE}'  # Replace with CLSID from event
$CLSIDPath = "HKLM:\SOFTWARE\Classes\CLSID\$CLSID"

if (Test-Path $CLSIDPath) {
    $CLSIDInfo = Get-ItemProperty -Path $CLSIDPath -ErrorAction SilentlyContinue
    Write-Host "Application: $($CLSIDInfo.'(default)')" -ForegroundColor Green
    
    # Check for InprocServer32 or LocalServer32
    $InprocPath = "$CLSIDPath\InprocServer32"
    $LocalPath = "$CLSIDPath\LocalServer32"
    
    if (Test-Path $InprocPath) {
        $ServerInfo = Get-ItemProperty -Path $InprocPath
        Write-Host "Server Path: $($ServerInfo.'(default)')" -ForegroundColor Cyan
    }
    
    if (Test-Path $LocalPath) {
        $ServerInfo = Get-ItemProperty -Path $LocalPath
        Write-Host "Local Server: $($ServerInfo.'(default)')" -ForegroundColor Cyan
    }
} else {
    Write-Host "CLSID not found in registry" -ForegroundColor Red
}

2. Check if the application service is running properly:

# Check related services
Get-Service | Where-Object {$_.DisplayName -like '*YourApp*' -or $_.ServiceName -like '*YourApp*'} | Format-Table Name, Status, StartType

3. Verify the requesting user has appropriate permissions
4. Check Application Event Log for related errors:

Get-WinEvent -FilterHashtable @{LogName='Application'; Level=2,3} -MaxEvents 50 | Where-Object {$_.TimeCreated -gt (Get-Date).AddHours(-2)} | Format-Table TimeCreated, Id, LevelDisplayName, ProviderName, Message -Wrap

5. If the application is critical, contact the vendor for DCOM configuration guidance

Use advanced tools to trace DCOM activation attempts and identify root causes.

1. Enable detailed DCOM logging in the registry:

# Enable DCOM error logging (use with caution)
$DCOMLogPath = "HKLM:\SOFTWARE\Microsoft\Ole"
Set-ItemProperty -Path $DCOMLogPath -Name "EnableDCOMHTTP" -Value 1 -Type DWord
Set-ItemProperty -Path $DCOMLogPath -Name "CallFailureLoggingLevel" -Value 1 -Type DWord

# Restart DCOM service to apply changes
Restart-Service -Name "DcomLaunch" -Force

2. Download and run Process Monitor (ProcMon) from Microsoft Sysinternals
3. Set filters to capture DCOM-related activity:

# PowerShell script to analyze recent DCOM events with timing
$Events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=10016} -MaxEvents 100

$EventAnalysis = $Events | Group-Object {$_.TimeCreated.ToString('yyyy-MM-dd HH:mm')} | ForEach-Object {
    [PSCustomObject]@{
        TimeWindow = $_.Name
        EventCount = $_.Count
        UniqueUsers = ($_.Group | ForEach-Object {($_.Message -split 'SID \(')[1] -split '\)')[0]} | Sort-Object -Unique).Count
        UniqueCLSIDs = ($_.Group | ForEach-Object {($_.Message -split 'CLSID ')[1] -split ' and')[0]} | Sort-Object -Unique).Count
    }
}

$EventAnalysis | Format-Table -AutoSize

4. Use Windows Performance Toolkit (WPT) for detailed COM tracing if available
5. Check for patterns in event timing that correlate with application launches or system events
6. Document findings and create monitoring alerts for non-benign patterns:

# Create a scheduled task to monitor for unusual 10016 patterns
$TaskAction = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-WindowStyle Hidden -Command 'Get-WinEvent -FilterHashtable @{LogName=\"System\"; Id=10016} -MaxEvents 50 | Where-Object {$_.TimeCreated -gt (Get-Date).AddMinutes(-15)} | Export-Csv C:\Logs\DCOM_10016_$(Get-Date -Format yyyyMMdd_HHmm).csv -NoTypeInformation'"

$TaskTrigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 15)

Register-ScheduledTask -TaskName "DCOM_10016_Monitor" -Action $TaskAction -Trigger $TaskTrigger -Description "Monitor DCOM 10016 events for analysis"