Microsoft-Windows-COMRuntime

Fields #

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COMRuntime",
    "guid": "{BF406804-6AFA-46E7-8A48-6C357E1D6D61}",
    "event_source_name": "",
    "event_id": 2,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": "0x4000000000000002",
    "time_created": "2026-06-02T05:14:54.111+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{431EA5F1-C4C9-4A44-A885-A4F9F25D7908}"
    },
    "execution": {
      "process_id": 4304,
      "thread_id": 17928
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CallResult": 0,
    "CallTimeMs": 2985,
    "Flags": 0,
    "TargetInterface": "{A5EBA07A-DAE8-4D15-B12F-728EFD8A9866}",
    "TargetMethod": 3,
    "TargetProcessId": 20648,
    "TargetThreadId": 0
  },
  "message": "ComCallDelay"
}

Fields #

Fields #

Fields #

Fields #

Fields #

Description

DCOM server attempted to listen on an invalid endpoint. Protocol Sequence: ProtocolSequence Endpoint: Endpoint Flags: Flags.

Message #

DCOM server attempted to listen on an invalid endpoint. Protocol Sequence: %1 Endpoint: %2 Flags: %3

Fields #

Description

The machine wide limit settings do not grant param1 param2 permission for the COM Server application with CLSID.

Message #

The machine wide limit settings do not grant %1 %2 permission for the COM Server application with CLSID 
%3
 and APPID 
%4
 to the user %5\%6 SID (%7) from address %8 running in the application container %9 SID (%10). This security permission can be modified using the Component Services administrative tool.

Fields #

Description

The param1 permission settings do not grant param2 param3 permission for the COM Server application with CLSID.

Message #

The %1 permission settings do not grant %2 %3 permission for the COM Server application with CLSID 
%4
 and APPID 
%5
 to the user %6\%7 SID (%8) from address %9 running in the application container %10 SID (%11). This security permission can be modified using the Component Services administrative tool.

Fields #

Related Events #

Description

The param1 permission settings do not grant param2 access permission to the COM Server application param3 with APPID.

Message #

The %1 permission settings do not grant %2 access permission to the COM Server application %3 with APPID 
%4
 to the user %5\%6 SID (%7) from address %8 running in the application container %9 SID (%10). This security permission can be modified using the Component Services administrative tool.

Fields #

Description

The application-specific permission settings do not grant param1 access permission to the COM Server application param2 with APPID.

Message #

The application-specific permission settings do not grant %1 access permission to the COM Server application %2 with APPID 
%3
 to the user %4\%5 SID (%6) from address %7 running in the application container %8 SID (%9). The application set this security permission programmatically; to modify this security permission contact the application vendor.

Fields #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/previous-versions/troubleshoot/windows-server/events-18210-3041-and-1-hyper-v-replica

Description

The machine wide limit settings do not grant param1 access permission to the COM Server application param2 with APPID.

Message #

The machine wide limit settings do not grant %1 access permission to the COM Server application %2 with APPID 
%3
 to the user %4\%5 SID (%6) from address %7 running in the application container %8 SID (%9). This security permission can be modified using the Component Services administrative tool.

Fields #

Description

The machine wide param1 param2 security descriptor is invalid. It contains Access Control Entries with permissions that are invalid. The requested action was therefore not performed. This security permission can be corrected using the Component Services administrative tool.

Message #

The machine wide %1 %2 security descriptor is invalid. It contains Access Control Entries with permissions that are invalid. The requested action was therefore not performed. This security permission can be corrected using the Component Services administrative tool.

Fields #

Description

The launch and activation security descriptor for the COM Server application with APPID.

Message #

The launch and activation security descriptor for the COM Server application with APPID 
%1
 is invalid. It contains Access Control Entries with permissions that are invalid. The requested action was therefore not performed. This security permission can be corrected using the Component Services administrative tool.

Fields #

Description

The param1 access security descriptor for the COM Server application param2 with APPID.

Message #

The %1 access security descriptor for the COM Server application %2 with APPID 
%3
 is invalid. It contains Access Control Entries with permissions that are invalid. The requested action was therefore not performed. This security permission can be corrected using the Component Services administrative tool.

Fields #

Description

The application-specific access security descriptor for the COM Server application param1 with APPID.

Message #

The application-specific access security descriptor for the COM Server application %1 with APPID 
%2
 is invalid. It contains Access Control Entries with permissions that are invalid. The requested action was therefore not performed.  The application set this security permission programmatically; to modify this security permission contact the application vendor.

Fields #

Description

The machine wide group policy param1 Limits security descriptor is invalid. The security descriptor is defined as an invalid Security Descriptor Definitions Language (SDDL) string. The requested action was therefore not performed. Please contact your administrator to get the security descriptor corrected in the Group Policy settings.

Message #

The machine wide group policy %1 Limits security descriptor is invalid. The security descriptor is defined as an invalid Security Descriptor Definitions Language (SDDL) string. The requested action was therefore not performed. Please contact your administrator to get the security descriptor corrected in the Group Policy settings.

Fields #

Description

The machine wide limit settings do not grant param1 param2 permission for COM Server applications to the user param3\param4 SID (param5) from address param6 running in the application container param7 SID (param8). This security permission can be modified using the Component Services administrative tool.

Message #

The machine wide limit settings do not grant %1 %2 permission for COM Server applications to the user %3\%4 SID (%5) from address %6 running in the application container %7 SID (%8). This security permission can be modified using the Component Services administrative tool.

Fields #

Related Events #

Fields #

Description

The attempt to connect to the RPCSS service was denied access for the COM Server application param1 to the user param2\param3 SID (param4) running in the application container param5 SID (param6). The most likely cause is that the machine wide Access Limits do not grant the user or application local access permissions. The Access Limits can be modified using the Component Services administrative tool.

Message #

The attempt to connect to the RPCSS service was denied access for the COM Server application %1 to the user %2\%3 SID (%4) running in the application container %5 SID (%6). The most likely cause is that the machine wide Access Limits do not grant the user or application local access permissions. The Access Limits can be modified using the Component Services administrative tool.

Fields #

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-COMRuntime",
    "guid": "{BF406804-6AFA-46E7-8A48-6C357E1D6D61}",
    "event_source_name": "",
    "event_id": 32769,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": "0x2000000000000000",
    "time_created": "2026-06-02T05:15:00.216+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 21100,
      "thread_id": 18468
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "param1": "Undefined",
    "param2": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
    "param3": "Windows.Internal.StateRepository.FileTypeAssociation"
  },
  "message": ""
}

Description

DCOM server attempted to listen on an invalid endpoint. Protocol Sequence: {param1} Endpoint: {param2} Flags: {param3}.

Message #

DCOM server attempted to listen on an invalid endpoint. Protocol Sequence:  {param1} Endpoint: {param2} Flags:    {param3}

Fields #

Message #

The machine wide limit settings do not grant {param1} {param2} permission for the COM Server application with CLSID {param3} and APPID {param4} to the user {param5}\{param6} SID ({param7}) from address %8. This security permission can be modified using the Component Services administrative tool.

Fields #

Message #

The {param1} permission settings do not grant {param2} {param3} permission for the COM Server application with CLSID {param4} and APPID {param5} to the user {param6}\{param7} SID ({param8}) from address %9. This security permission can be modified using the Component Services administrative tool.

Fields #

Message #

The {param1} permission settings do not grant {param2} access permission to the COM Server application {param3} with APPID {param4} to the user {param5}\{param6} SID ({param7}) from address {param8}. This security permission can be modified using the Component Services administrative tool.

Fields #

Message #

The application-specific permission settings do not grant {param1} access permission to the COM Server application {param2} with APPID {param3} to the user {param4}\{param5} SID ({param6}) from address {param7}. The application set this security permission programmatically; to modify this security permission contact the application vendor.

Fields #

Message #

The machine wide limit settings do not grant {param1} access permission to the COM Server application {param2} with APPID {param3} to the user {param4}\{param5} SID ({param6}) from address {param7}. This security permission can be modified using the Component Services administrative tool.

Fields #

Message #

The machine wide {param1} {param2} security descriptor is invalid. It contains Access Control Entries with permissions that are invalid. The requested action was therefore not performed. This security permission can be corrected using the Component Services administrative tool.

Fields #

Message #

The launch and activation security descriptor for the COM Server application with APPID {param1} is invalid. It contains Access Control Entries with permissions that are invalid. The requested action was therefore not performed. This security permission can be corrected using the Component Services administrative tool.

Fields #

Message #

The {param1} access security descriptor for the COM Server application {param2} with APPID {param3} is invalid. It contains Access Control Entries with permissions that are invalid. The requested action was therefore not performed. This security permission can be corrected using the Component Services administrative tool.

Fields #

Message #

The application-specific access security descriptor for the COM Server application {param1} with APPID {param2} is invalid. It contains Access Control Entries with permissions that are invalid. The requested action was therefore not performed.  The application set this security permission programmatically; to modify this security permission contact the application vendor.

Fields #

Message #

The machine wide group policy {param1} Limits security descriptor is invalid. The security descriptor is defined as an invalid Security Descriptor Definitions Language (SDDL) string. The requested action was therefore not performed. Please contact your administrator to get the security descriptor corrected in the Group Policy settings.

Fields #

Message #

The machine wide limit settings do not grant {param1} {param2} permission for COM Server applications to the user {param3}\{param4} SID ({param5}) from address {param6}. This security permission can be modified using the Component Services administrative tool.

Fields #

Description

OLE (Object Linking and Embedding) in the application "param1" was trying to convert embedded content in a document; however, OLE no longer supports the presentation format for the embedded content. Newer versions of this application may support this presentation format natively.

Message #

OLE (Object Linking and Embedding) in the application "%1" was trying to convert embedded content in a document; however, OLE no longer supports the presentation format for the embedded content.  Newer versions of this application may support this presentation format natively.

Fields #