I get a lot of these


Posts: 1,721   +452
Hi I get a lot of these in the event viewer. Anyone want to comment? Should I be worried?
Log Name: System
Source: Microsoft-Windows-DistributedCOM
Date: 2/2/2018 12:27:29 PM
Event ID: 10016
Task Category: None
Level: Error
Keywords: Classic
User: GARY-PC\Gary
Computer: Gary-PC
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
to the user Gary-PC\Gary SID (S-1-5-21-3942731526-1549951770-3740554991-1000) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.Cortana_1.9.6.16299_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742). This security permission can be modified using the Component Services administrative tool.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
<EventID Qualifiers="0">10016</EventID>
<TimeCreated SystemTime="2018-02-02T18:27:29.677517400Z" />
<Correlation />
<Execution ProcessID="72" ThreadID="7644" />
<Security UserID="S-1-5-21-3942731526-1549951770-3740554991-1000" />
<Data Name="param1">machine-default</Data>
<Data Name="param2">Local</Data>
<Data Name="param3">Activation</Data>
<Data Name="param4">{C2F03A33-21F5-47FA-B4BB-156362A2F239}</Data>
<Data Name="param5">{316CDED5-E4AE-4B15-9113-7055D84DCC97}</Data>
<Data Name="param6">Gary-PC</Data>
<Data Name="param7">Gary</Data>
<Data Name="param8">S-1-5-21-3942731526-1549951770-3740554991-1000</Data>
<Data Name="param9">LocalHost (Using LRPC)</Data>
<Data Name="param10">Microsoft.Windows.Cortana_1.9.6.16299_neutral_neutral_cw5n1h2txyewy</Data>
<Data Name="param11">S-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742</Data>


  • What is an Lrpc?
    Lightweight Remote Procedure Call (LRPC) is a communication facility designed and optimized for communication between protection domains on the same machine. (so this is MS TO MS on your system)
  • Cause
    The event logs are recorded because certain processes don't have permissions to the DCOM components that are mentioned in the event logs. The specific communications that are blocked are determined to have no adverse functionality other than generating 10016 event logs. These event logs can be safely ignored.
  • see this for workaround


Posts: 1,721   +452
Thanks! I have been ignoring that error for a very long time. I prefer my Reliability Monitor to view windows errors. The event viewer generates every little event , so I seldom go there.
PS I guess we can mark this as solved. That's the only error in the event viewer that I got. I don't think I'll ever have a error free event driver.;)
Last edited: