none
Errors discovered after anniversary update V.1607 build 14393.10

    Question

  • Hello everyone,
    I installed dual boot version of windows 10 pro 32 bit V.1607 build 14393.10, as an upgrade and the other as a clean installation.

    In clean install,
    The strange thing I found is that the users I have 3 folders <My account> <default (hidden)> <defaultuser0>
    it's normal?
    While in the updated version is not present <defaultuser0>.

    Error in clean install:
    evnt error: Search id 3104 Gatherer
    Could not enumerate the user sessions for the generation of the filter pooh.
    Details: (HRESULT: 0x80040210) (0x80040210)
    and
    DistributedCOM id 10016
    Settings specific permissions settings do not grant Local Activation permission for the COM Server application with CLSID
    {8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
    e APPID
    {F72671A9-012C-4725-9D2F-2A4D32D65169}
    to the user NT AUTHORITY \ SYSTEM SID (S-1-5-18) address LocalHost (via LRPCs) running in the CIS of the applications container Not Available (Not Available). To change the security clearance, you can use the Component Services administrative tool.

    Error in the updated version:
    Event ID 4401
    Source: EFS
    Message: 7,488: The EFS service could not run the provisioning of a user for enterprise data protection.
    Error code: 0x80070005. (I have no one game or app. on another drive that is referenced by the C)
    and:
    DistributedCOM id 10016
    Settings specific permissions settings do not grant Local Activation permission for the COM Server application with CLSID
    {8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
    e APPID
    {F72671A9-012C-4725-9D2F-2A4D32D65169}
    to the user NT AUTHORITY \ SYSTEM SID (S-1-5-18) address LocalHost (via LRPCs) running in the CIS of the applications container Not Available (Not Available). To change the security clearance, you can use the Component Services administrative tool.

    Thank you

    Windows 10 Pro 32-Bit; ASUS P5G41T-M LE; RAM 4GB; CPU Intel Core Duo E8600 @ 3.33 GHz; Nvidia Quadro FX3700

    Saturday, August 6, 2016 10:35 AM

Answers

  • Yep, I have also seen such errors on my computer, and it seems that I cannot find the AppID in my registry key, that cause my failure to find the proper DCOM service.

    I will feedback this issue:

    The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

    {B6891650-D273-4F34-84FF-AAC043EC8956}

    and APPID

    {B0316D0C-DA2F-40E0-9F91-F600CAF042DC}

    to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.


    Please remember to mark the replies as an answers if they help and unmark them if they provide no help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Marked as answer by alpha45 Saturday, August 27, 2016 10:12 AM
    Thursday, August 18, 2016 11:30 AM
    Owner

All replies

  • These DCOM errors have been seen in Windows 10 for sometime, been reported in the Feedback Hub. Search this forum for DCOM there are many reports of these errors.

    Repeated DCOM errors - possibly Cortana related? being one.

    So any other issues? These errors are common so not ideal but they can be safely ignored.

    The defaultuser0 is also present on my working Windows 10 1607 systems, I also get the DCOM errors if I look for them but the system are working as expected.

    Saturday, August 6, 2016 5:39 PM
  • I'm having this exact same issue. When I do a clean install of Windows 10 Anniversary Update (1607) the setup process works fine, but when I log in and navigate to C: /Users it shows three accounts. A hidden "default" account, my own local account, and this "defaultuser0." It is possible to delete this account by manipulating the necessary registry keys, but nobody know why it gets created in the first place. What's worse, is that SFC and Dism will restore these files anyway. I contacted Microsoft's tech support directly, but even their Level Two support team doesn't know what causes it. Here is more information:

    http://answers.microsoft.com/en-us/windows/forum/windows_10-security/defaultuser0-created-on-clean-install-of/e2333e94-ef5f-4932-8754-fd4ce27ae33b

    I'm posting this link here because I believe the more people chime in, the sooner the Microsoft devs will be able to troubleshoot a solution or at least offer a patch.
    Saturday, August 6, 2016 6:31 PM
  • Hi,

    I have installed all windows update after this upgrade, and my current build is 14393.51.

    I will monitor to see if there is the similar errors, please check your system issues also when installed all updates.

    https://support.microsoft.com/en-us/kb/3176495


    Please remember to mark the replies as an answers if they help and unmark them if they provide no help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.


    Wednesday, August 10, 2016 2:09 PM
    Owner
  • yes.  same problem. new build, not an update.  windows pro 1607.  everything else works perfectly. very little installed so far, but do get the 3104 event every morning around 8:15 AM.

    the 10016 event has been around for more than a year in all windows 8 and 10 builds so i just ignore it.  ms never attempted to fix that one and it was not correlated with any actual problems, so i just ignore it (along with a few others that are well known).  but the 3104 seems to be new since build 1607 so i'm curious whether this is going into the "important and will fix" or "ignore it" bin.

    Saturday, August 13, 2016 4:07 PM
  • Yep, I have also seen such errors on my computer, and it seems that I cannot find the AppID in my registry key, that cause my failure to find the proper DCOM service.

    I will feedback this issue:

    The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

    {B6891650-D273-4F34-84FF-AAC043EC8956}

    and APPID

    {B0316D0C-DA2F-40E0-9F91-F600CAF042DC}

    to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.


    Please remember to mark the replies as an answers if they help and unmark them if they provide no help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Marked as answer by alpha45 Saturday, August 27, 2016 10:12 AM
    Thursday, August 18, 2016 11:30 AM
    Owner
  • Here are Answers to the three issues of initial post:

    1. Default User(): This is a left over from the Windows 10 Anniversary update that just did not get cleaned up at the end of the update. It does not cause any harm and you can safely ignore it. There is not much you can do about it anyway. If interested further: https://answers.microsoft.com/en-us/windows/forum/windows_10-security/defaultuser0-created-on-clean-install-of/e2333e94-ef5f-4932-8754-fd4ce27ae33b?page=1

    2. Event ID 3104  error:  Rebuilding your Search Index should fix this.

    • Click Start      and then click Control Panel.
    • In Classic      View of the Control Panel, double-click Indexing Options.
    • Click Advanced.     
    • If the User      Account Control dialog box appears, confirm that the action it      displays is what you want, and then click Continue.
    • On the Index      Settings tab, click Rebuild.
    • Click OK.

    3. DCOM 10016 Errors: These 10016 DCOM errors occur fairly frequently. Here my general fix for 10016 DCOM errors that has worked for all that I have tried it on except for RuntimeBroker {9CA88EE3-ACB7-47c8-AFC4-AB702511C276} and my fix for that can be seen at RuntimeBroker Fix .

                                  Fix for Distributed COM Error ID: 10016

    This fix is for 10016 DCOM errors which have an error message that looks something like this:

    Make sure that you have administrator privileges before starting. First go to Control Panel > Administrative Tools > Component Services > Computers > My Computer > DCOM Config and then right click on the Application from the error information (listed after “and APPID”) that is causing the problem and click Properties > Security tab where you will see 3 edit buttons. Because the Names are sorted rather than the AppID first check the end of the list where there are many that are not named and just go by their APPID, then to find the Apps name open the registry editor (Right click Windows icon > Run > regedit > Enter) and do a search for it (Edit > Find).

    If you can click Customize and its Edit button then go to step 5, but if you can not (Customize the Edit button are faded) then you need to open the Registry Editor (Right click Windows icon > Run > regedit > Enter) and change permissions for the APPID by doing Steps 1–4. [Note: You should probably back up any registry keys that you are going to change by doing a right click on the key and exporting it to a folder and then you can import the key back in when done rather than having to change the permissions back at the end.]

    1. Open the Registry Editor (Right click Windows icon > Run > regedit > Enter) and go to HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\. Make a note of the name of the service listed in (Default) Data.
    2. Right click on it again and choose Permissions > Advanced and make note of the privileges for so you can change it back later. Click Change next to Owner and then click Advanced > Find Now > Administrators > OK > OK > check the box below the Owner > Apply.
    3. Click on Administrators > Edit and check Full Control then click OK.
    4. Check "Replace all child objects...." and then Apply.  If a message(s) comes up just click OK or Yes until back to the Permissions window.  Then click OK>OK to close the Permissions window.[Note: While changing the AppID permissions should be all you need to change, if you have any problems in getting access to the AppID Component Services do a find for the CLSID and also change the permissions there.]
    5. Go to Component Services (Control Panel > Administrative Tools > Component Services) and right click on My Computer then click COM Security. Click the Edit Default under Access Permissions and make sure that you have in the Group or User Names window: All Applications Packages, Self, System, and Administrators. If any are missing, then click Add > Advanced > Find Now > [Name]> OK > OK, and make sure that System and All Application Packages have just Local Access checked. are checked for each. When done click OK to get back the Properties window. OK > OK to get back to the console. Do the same for the Default Edit button for the Launch and Activation Permissions and make sure you have at least: Applications Packages, System, Interactive. and Administrators. Applications Packages and System should just have the two Local boxes checked while the other two should have all of them checked.
    6. Click on My Computer in the Console and then click DCOM Config (make sure View is Detail) and in the right column right click on the name of the service you saw in the registry key (Default) Data (which should have the APPID that you changed in the registry) and click Properties > Security.  You’ll see 3 edit buttons. You should now be able to click Customize on all of them and the Edit button is now longer faded.
    7. Under Launch and Activation Permissions, make sure Customize is checked and then click on Edit. Make sure that you have in the Group or User Names window: All Applications Packages, System, Administrator, and Interactive (it is fine if there are others). If any are missing, then click Add > Advanced > Find Now > [Name]> OK > OK. System and All Applications Packages  should have just the Local boxes checked (OK if the latter two have all checked) while Administrator and Interactive should have all checked. When done click OK to get back the Properties window.
    8. Under Access Permissions, make sure Customize is checked and click the Edit button. Make sure that you have in the Group or User Names window: All Applications Packages, System, Users (or Self), and Administrators (it is fine if there are others). If any are missing, then click Add > Advanced > Find Now > [Name]> OK > OK. System and All Applications Packages should have the Local box checked (OK if the latter has both checked) while Administrator and Users (or Self) should have both checked. When done click OK to get back the Properties window.
    9. Under Configuration Permissions, make sure Customize is checked and click the Edit button then click Advanced. You should have the following principals listed: All Applications Packages, System, Administrators, and Users (it is fine if there are others). If any are missing, then click Add > Advanced > Find Now > [Name] > OK. All of them should have Read Access while Administrators, System, and Trusted Installer (if present) will also have Full (ignore Special Permissions for all of them).  If you need to make any changes, highlight the one to change then click Edit, make any changes, and then click OK. Then click OK until all the Properties windows are closed. Now click OK to close up the Component Services window.
    10. If you did not have to change any registry permissions (Steps 1-4) then go to Step 11, otherwise go back to the Registry Editor and the key you changed. In the top menu under View, click Refresh. Go back to the same key you changed and again right click on it and choose Permissions. If you saved the registry key, you can just import it otherwise change the privileges back manually and then ownership back to what they initially were. If ownership was Trusted Installer, type (not paste) “NT SERVICE\TrustedInstaller” for a name (it is not listed in the name finder) or just use System instead. You should use the  Advanced > Find Now > SYSTEM > OK > OK > check the box method rather than typing in the name. When done click OK until Permissions window is closed (if any messages come up just click OK or Yes until Permissions window is closed).
    11. Close the Registry Editor and reboot. That should do it.

    • Proposed as answer by JSiepmann Sunday, December 4, 2016 11:19 AM
    • Edited by JSiepmann Wednesday, December 7, 2016 4:54 AM
    Sunday, December 4, 2016 11:12 AM
  • Thank you for posting this detailed instruction. I was able to follow up to step 10. The original ownership for all those keys was: "Trustedinstaller", but that one is not listed when I use Advanced > Find Now. Should I use SYSTEM instead?

    Before step 1 I had exported the registry keys, but restoring them doesn't seem to restore permissions.


    EDIT: I think I found it. When I type NT SERVICE\TrustedInstaller and click Ckeck names, it is listed.
    • Edited by willemb4u Sunday, December 4, 2016 3:58 PM
    Sunday, December 4, 2016 3:50 PM