How to Fix Event ID 10016 (DistributedCOM) in Windows 11

Viewing the Windows 11 Event Viewer system log frequently reveals warnings or errors referencing Event ID 10016, DistributedCOM. The log entry states: “The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID… and APPID… to the user NT AUTHORITY\SYSTEM or Local Service.”

While Microsoft design principles consider most DistributedCOM warnings benign and self-correcting during background execution, high volumes of Event ID 10016 entries can cause system stuttering, delayed application launching, and micro-freezes. Modifying the affected component’s security descriptor resolves the underlying permission blockage.

Component Identifier	Standard System Component	Impact on Windows 11
RuntimeBroker DCOM	Application permissions manager for Microsoft Store apps	Periodic taskbar latency, Explorer sluggishness
ShellServiceHost DCOM	Desktop Shell experience and notification flyouts	Action Centre delays, notification freeze
Immersive Shell DCOM	Modern Windows UI elements and start menu hooks	Start menu hesitation on cold launch

Method 1: Identify the Affected CLSID and APPID in Event Viewer

Before modifying any security descriptors, extract the exact alphanumeric identifiers logged by the system.

1. Right-click the Start button and select Event Viewer.
2. Expand Windows Logs in the left pane and click System.
3. In the center pane, locate the warning with Event ID 10016 and source DistributedCOM.
4. Read the description text and note down the curly-bracketed values for:
   • CLSID (e.g. {2593F8B9-4EAF-47C4-8D4F-5F87703322E8})
   • APPID (e.g. {15C20B67-12E7-4BB6-92BB-7AFF07997402})

Method 2: Take Ownership of the Component in Registry Editor

Windows protects DCOM entries under the TrustedInstaller service account by default. You must assign ownership to the local Administrators group before modifying launch permissions.

1. Press Windows Key + R, type regedit, and press Enter.
2. Navigate to:
   HKEY_CLASSES_ROOT\AppID\{YOUR-APPID-HERE}
3. Right-click the AppID folder key and select Permissions.
4. Click the Advanced button.
5. Adjacent to Owner: TrustedInstaller, click Change.
6. In the object name box, enter Administrators and click Check Names, then click OK.
7. Check the box labelled Replace owner on subcontainers and objects, then click Apply.
8. Under Permissions for Administrators, check Full Control, then click OK.

Method 3: Grant Local Activation Permissions in Component Services

Once ownership has been transferred, utilize the Component Services administrative console to permit the designated system service to activate the COM server.

1. Press Windows Key + R, type dcomcnfg, and press Enter to open Component Services.
2. Expand Component Services > Computers > My Computer > DCOM Config.
3. Click the View menu at the top and select Detail.
4. Locate the application corresponding to the AppID identified in Step 1 (often RuntimeBroker or ShellServiceHost). Alternatively, press Ctrl + F to search by AppID string.
5. Right-click the application and select Properties.
6. Switch to the Security tab.
7. Under Launch and Activation Permissions, verify that Custom is selected, then click Edit.
8. Click Add, enter LOCAL SERVICE (or the user account named in your Event Viewer log), and click OK.
9. Select the newly added account and check the Allow box for:
   • Local Launch
   • Local Activation
10. Click OK, apply the changes, and reboot Windows 11.

Method 4: Execute System File Checker and DISM Scans

If Event ID 10016 appears concurrently with missing registry handles or corrupted manifest payloads, repairing system components via command-line restores baseline security definitions.

1. Press Windows Key + S, type powershell, right-click Windows PowerShell, and select Run as administrator.
2. Type the following command to check image integrity:
   DISM /Online /Cleanup-Image /RestoreHealth
3. Allow the online servicing tool to complete its payload verification.
4. Next, execute:
   sfc /scannow
5. Once the SFC tool reports successful verification or repaired corrupted files, reboot your system.

Understanding Microsoft Guidance Regarding DCOM Warnings

Official Microsoft technical documentation clarifies that isolated Event ID 10016 events are normal behaviour within the Windows platform, occurring when internal components attempt to contact DCOM servers with insufficient permissions before falling back to alternative protocols. Suppressing or remediating them is primarily recommended when correlating log timestamps with tangible user interface latency or stability issues.