Windows securitycenter securityappbroker 10016

If we install Windows 11 and we look in the Event System Log, we can see three types of “Event 10016 Windows.SecurityCenter DistributedCOM” Warnings:

1. The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
   Windows.SecurityCenter.WscCloudBackupProvider
   and APPID
   Unavailable
   to the user Username SID (…) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
2. The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
   Windows.SecurityCenter.SecurityAppBroker
   and APPID
   Unavailable
   to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
3. The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
   Windows.SecurityCenter.WscDataProtection
   and APPID
   Unavailable
   to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Microsoft recommendation is (DCOM event ID 10016 is logged in Windows):
“These events can be safely ignored because they don’t adversely affect functionality and are by design. It’s the recommend action for these events.”

However, these warnings are very annoying and can confuse anyone, that something is wrongly configured.

Analysis:

The problem is related to the Windows Security Center. The Windows Security Center service (wscsvc) has a delayed automatic start. WscCloudBackupProvider, SecurityAppBroker and WscDataProtection objects start earlier with the OS. As soon as the objects are active, they try to communicate with the Windows Security Center service (wscsvc), which is not started. That is why, we get Event 10016 warnings.

Solution:

Solution of this problem is unusual. It has nothing to do with Local Launch permissions. We should start Windows Security Center service earlier, during OS starting procedure.

If we look at the registry with Registry Editor (regedit.exe), we can find Windows Security Center service settings at:
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc

We have to change the DelayedAutoStart DWORD Value From 1 to 0.

Картинка с сайта: blog.scng.si

We can’t do it right away, because we don’t have a permission to do it. We right click on the wscsvc Registry Key and select Permissions…First, we need to change the owner of Registry Key. Go to Advanced, Change Owner from System to the Administrators group (local Administrators group, if computer is member of domain), select OK twice. Then open the Permissions window once again and change permissions of Administrators group to Full Control.

Now, we can change the DelayedAutoStart DWORD Value From 1 to 0. In this way, the Windows Security Center will start earlier.

That’s it. After OS restart, we will not see Event 10016 Windows.SecurityCenter Warnings anymore.

I invite you to solve also Event 10016 PerAppRuntimeBroker Warning in Windows 11!

Written by Simon Abolnar

I am a lecturer of Informatics subjects at Higher Vocational College at the School Center Nova Gorica, located in Slovenia-EU. I have been a System Administrator of Microsoft Servers at SCNG for over 20 years.

1. Event ID 10016, DistributedCOM Windows.SecurityCenter.WscBrokerManager

   Sounds like we might all learn something from your further investigations. Do keep us posted, please. Best of luck in running this to ground.
   —Ed—

2. Greetings.

   Updated to 1803 17134.1 without a problem but one error — Distributed COM event ID 10016.
   Experienced this event ID many times previously and have fixed by changing permissions in Registry but this one has no known CLSID/APPID.

   «The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
   Windows.SecurityCenter.WscBrokerManager
   and APPID
   Unavailable
   to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.»

   Code: — System — Provider [ Name] Microsoft-Windows-DistributedCOM [ Guid] {1B562E86-B7AA-4131-BADC-B6F3A001407E} [ EventSourceName] DCOM — EventID 10016 [ Qualifiers] 0 Version 0 Level 2 Task 0 Opcode 0 Keywords 0x8080000000000000 — TimeCreated [ SystemTime] 2018-05-01T13:13:11.470871100Z EventRecordID 1072 Correlation — Execution [ ProcessID] 512 [ ThreadID] 1876 Channel System Computer — Security [ UserID] S-1-5-18 — EventData param1 application-specific param2 Local param3 Launch param4 Windows.SecurityCenter.WscBrokerManager param5 Unavailable param6 NT AUTHORITY param7 SYSTEM param8 S-1-5-18 param9 LocalHost (Using LRPC) param10 Unavailable param11 Unavailable [/quote]
   I am guessing this is nothing serious but I just can not stand an error showing in Event Viewer.
   Your advises much appreciated.

   *Smile

   

3. Since the Fall Creators Update, my computer freezes every other day, even after a clean Windows (10) reset

   Try to fix 10016 like this

   Error — Event ID: 10016; DistributedCOM

4. Event ID 10016, DistributedCOM Windows.SecurityCenter.WscBrokerManager

   Event log writes error related to application-specific permissions on Windows 10 computer

   Event ID 10016 — DistributedCOM

   

   Картинка с сайта: www.windowsphoneinfo.com

5. Search for the GUID in regedit.exe instead. You may learn something interesting. That’s about all you have to go on, really.
   HTH,
   —Ed—

6. Yes, get rid of the error by going into the Event Viewer and clicking on the event then click on the details tab and then finally the (+) symbol next to System. The GUID will be revealed and just simply copy and paste it into the Registry Search function with the «Keys» checkbox ticked and delete the GUID wherever it appears in the Registry.

   My GUID appeared in two locations in the registry and I deleted both without harm being done to Start Up and booting procedures.

   Make sure you have a backup of the Registry first, that you get through the Command Prompt in the Recovery environment just in case anything should go wrong.

7. Thank you for your suggestions EdTittel and EyeInTheSky, and also Brink for the code box stuff.

   Since then I disabled the log so to ignore it for now.
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{1b562e86-b7aa-4131-badc-b6f3a001407e} changed the Enabled value data to 0.

   I still don’t know what it is so I’ll continue looking for explanation and solution.

   Regards,

   *Smile