Windows Event ID 10010 DCOM Timeout Error: Fixes & Commands

Windows Event ID 10010 is a DCOM error logged when a server fails to register its class factory within the required timeout, indicating a COM communication failure.

# PowerShell - Get last 10 DCOM 10010 events
Get-WinEvent -LogName System -MaxEvents 10 | Where-Object { $_.Id -eq 10010 } | Format-List

Retrieve and resolve Event ID 10010 using native Windows tools. Commands below apply to Windows 10 22H2, Windows 11 23H2, and Windows Server 2022.

Windows Event ID 10010 Syntax Reference

Query the System event log for Event ID 10010 with PowerShell or wevtutil. The following examples fetch the last 10 occurrences with full detail.

# PowerShell - Get last 10 DCOM 10010 events
Get-WinEvent -LogName System -MaxEvents 10 | Where-Object { $_.Id -eq 10010 } | Format-List

# wevtutil - Export to XML for offline analysis
wevtutil qe System /q:"*[System[EventID=10010]]" /c:10 /e:Root

For live monitoring, use Get-WinEvent with a hash table filter:

$filter = @{LogName='System';ID=10010}
Get-WinEvent -FilterHashTable $filter -MaxEvents 5 | Select TimeCreated, Message

Windows Event ID 10010 Rapid Reference Cheat Sheet

Advanced Implementation & Parameters

Understanding DCOM Registration Timeout

When a COM server fails to register its class factory within the DCOM timeout window, the system logs Event ID 10010 with the failing CLSID. The timeout can be adjusted via registry or Component Services MMC, but reducing it may cause false positives. Default timeout is typically 120 seconds in Windows 10/11 and Server 2016+.

# Registry path for DCOM timeout (in seconds)
HKEY_LOCAL_MACHINESOFTWAREMicrosoftOleDefaultTimeout
# Application-specific timeout example (CLSID-dependent)
HKEY_CLASSES_ROOTCLSID{00000000-0000-0000-0000-000000000000}LocalServer32

Event Detail Parsing

Each 10010 event contains the failing server’s CLSID and AppID. Use PowerShell to extract and identify the application:

# Extract AppID from event XML and resolve to display name
$events = Get-WinEvent -FilterHashTable @{LogName='System';ID=10010} -MaxEvents 1
$xml = [xml]$events[0].ToXml()
$appId = $xml.Event.EventData.Data | Where {$_.Name -eq 'param1'} | Select -ExpandProperty '#text'
# Query registry for AppID friendly name
Get-ItemProperty -Path "HKCR:AppID$appId" | Select-Object AppID, @{N='Name';E={$_.'(default)'}}

Error Resolution & Troubleshooting

Step‑by‑Step Resolution

1. Identify the failing component: In Event Viewer → Windows Logs → System, locate Event 10010. Note the CLSID and AppID from the Details pane.
2. Check affected service: Open Services.msc and verify that Function Discovery Resource Publication is running (automatic start). If not, enable it with:

   sc config fdPHost start= auto
   net start fdPHost

3. Disable problematic gaming service: If the CLSID matches {...GameBar.PresenceWriter...}, apply the registry workaround:

   reg add "HKLMSOFTWAREMicrosoftWindowsRuntimeActivatableClassIdWindows.Gaming.GameBar.PresenceServer.Internal.PresenceWriter" /v ActivationType /t REG_DWORD /d 0 /f

4. Repair DCOM permissions: Use dcomcnfg → Component Services → Computers → My Computer → Properties → COM Security → Edit Default Launch Permissions → Add NETWORK SERVICE with Local Launch permission.
5. Reinstall affected overlay: Open PowerShell as admin and run:

   Get-AppxPackage *xboxgamingoverlay* | Remove-AppxPackage
   Get-AppxPackage *xbox* | Remove-AppxPackage -AllUsers
   # Then reinstall from Microsoft Store or via winget:
   winget install "Xbox Game Bar"

Production-Grade Implementation

In enterprise environments, periodic logging of Event ID 10010 should not be ignored. Use the following best practices to harden DCOM:

• Monitor with Windows Event Forwarding: Collect events from domain members to a central collector using wecutil or Azure Arc.
• Apply least privilege: Do not set DCOM identity to Interactive User for production servers; use specific service accounts with only required launch/access permissions.
• Use Group Policy: Deploy the registry fix for GameBar Presence Writer via Computer Configuration → Preferences → Windows Settings → Registry.
• Patch management baseline: Test cumulative updates in a pilot group before broad deployment; errors like 10010 are often transient after a reboot.
• Automate rollback: If an update triggers widespread 10010 errors, script the removal of the update with wusa /uninstall /kb:5031445 /quiet /norestart and schedule reboot during maintenance window.

Frequently Asked Questions

Get-WinEvent -FilterHashtable @{LogName='System'; ID=10010} -MaxEvents 1

wevtutil qe System /q:"*[System[EventID=10010]]" /c:1 /rd:true /f:text

Get-WinEvent -FilterHashtable @{LogName='System'; ID=10010} -MaxEvents 1 | Select-Object -Property TimeCreated, Message

Get-WinEvent -ListLog System | Where-Object {$_.IsEnabled}

$servers = 'Server01','Server02','Server03'
$jobs = $servers | ForEach-Object -Parallel {
    Invoke-Command -ComputerName $_ -ScriptBlock {
        Get-WinEvent -FilterHashtable @{LogName='System'; ID=10010} -MaxEvents 5
    }
} -AsJob
$results = Receive-Job $jobs -Wait