How to fix DistributedCOM error 10005 in Windows?

DistributedCOM error 10005 is an Event Viewer entry that says Windows could not start a service a program asked for. The number in quotes, such as 1058 or 1115, tells you why, and often the event is harmless. Read that code first, then fix only the service it names.

Facts checked on 15 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2.

What DistributedCOM error 10005 means

DCOM (Distributed Component Object Model) lets one program use a component, a "server", that lives in another process. Many of these servers run inside Windows services. When a program asks for one, the DCOM Server Process Launcher service starts the service that hosts it. If that start fails, Windows writes event 10005 from the source DistributedCOM to the System log.

The event always has the same shape. Microsoft's Q&A thread on event 10005 shows the full text and its XML, where the four parts are stored as param1 to param4:

Event 10005, source DistributedCOM (a real example from a Windows Search failure)

DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server:
{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

• The code in quotes (param1) is a Windows system error code. It is the reason the service did not start, and the only part that decides the fix.
• "the service WSearch" (param2) is the short service name, the one you see on the General tab of the service in services.msc.
• "with arguments" (param3) is empty or says "Unavailable" on most PCs. It is not an error of its own.
• "in order to run the server:" (param4) is the DCOM component that was asked for, as a name or a class ID in braces.
• Older Windows wrote the code as %1058 or as the full sentence instead of the number. The meaning is the same.

What each code in the DCOM 10005 message means

Every code below is defined in Microsoft's list of system error codes 1000 to 1299. The text in the second column is Microsoft's own wording.

Why the DCOM 10005 error appears, most common cause first

The event has one technical trigger, a failed service start, but several reasons behind it. In the forum and Microsoft Q&A reports we checked, these come up in this order.

• Malware. Some guides list it as a cause. Nothing in Microsoft's documentation ties event 10005 to malware. A scan does no harm, but do not expect it to change these rows.
• Blue screens. Event 10005 is a log entry, not a crash. If your PC also shows blue screens, the crash has its own events, see the section on what to do if it is still broken.

When you can ignore event 10005 and when to act

Windows writes many harmless DCOM events, and this one is no exception. What matters is whether the service named in the event is needed for something that is broken on your PC. If nothing is broken and the code is 1115 or 1084, you can stop here.

How to fix DistributedCOM error 10005

Fix 1 takes five minutes and tells you which case you are in. Fix 2 to Fix 5 each match one code. Fix 6 is the general repair for a service that is set correctly and still fails. Use only the fix that matches your code.

Fix 1. Read the error code and the service name in Event Viewer

5 minutesNo riskEveryone who found event 10005, before changing anything.

Event 10005 is the same event for very different problems. The code in quotes and the service name tell you which one you have, and the PowerShell command counts them so you see which pair repeats.

1. Right-click Start and select Event Viewer.
2. Open Windows Logs > System.
3. Select Filter Current Log on the right, type 10005 in the <All Event IDs> box and select OK.
4. Select a row and read the General tab: note the code in quotes and the name after the service.
5. Compare the time stamps with your shutdowns and restarts. Rows in the last seconds before a shutdown with code 1115 are harmless.
6. For a count of every code and service pair, run the PowerShell command below.

PowerShell (as administrator): DCOM 10005 events of the last 7 days, counted by code and service

Get-WinEvent -FilterHashtable @{ LogName='System'; ProviderName='Microsoft-Windows-DistributedCOM'; Id=10005; StartTime=(Get-Date).AddDays(-7) } |
  Group-Object { "code $($_.Properties[0].Value)  service $($_.Properties[1].Value)" } |
  Sort-Object Count -Descending |
  Format-Table Count, Name -AutoSize

Properties[0] and Properties[1] are param1 (the code) and param2 (the service) of the event XML. If the command prints "No events were found", there were no 10005 rows in the last 7 days. We had no PC with these errors to run it against, so compare its output with Event Viewer once.

Fix 2. Set a disabled service back to its default startup type (code 1058)

5 minutesLow riskThe code is 1058 and the same service appears in every row.

Code 1058 means Windows refused to start the service because its startup type is Disabled. DCOM keeps asking for it, so the event repeats until the service may start again.

1. Press Win + R, type services.msc and press Enter.
2. Find the service. The event shows the short name (WSearch); the list shows the display name (Windows Search). The General tab of each service shows both.
3. Double-click it and check Startup type. If it says Disabled, that is the cause.
4. Set Startup type to the default for that service, then select Apply.
5. Select Start, then OK.
6. Restart the PC and run the Fix 1 command again.

Step by step, with the PowerShell way: Check and restart Windows services

Fix 3. Restart a slow or stuck service and find what delays it (code 1053)

10 to 30 minutesLow riskThe code is 1053, usually right after you sign in, and often for WSearch.

Code 1053 means the service did not report that it had started within the time Windows allows. A hung earlier start, a damaged search index or a third-party program that loads at the same time can cause that delay.

1. In services.msc, right-click the service and select Restart, or Start if it is stopped.
2. If it starts by hand without delay, the problem is at boot time only. Note the time of the next 10005 row after a restart.
3. For WSearch, rebuild the search index: on Windows 11 open Settings > Privacy & security > Searching Windows > Advanced indexing options, on Windows 10 Settings > Search > Searching Windows > Advanced Search Indexer Settings.
4. Select Advanced, then Rebuild, and select OK. Indexing runs in the background and can take a while.
5. If the service still fails at boot, do a clean boot to see whether a third-party service or startup app delays it.

Clean boot step by step, and how to undo it: How to perform a clean boot in Windows

Fix 4. Check the dependencies and the logon account of the service (codes 1068, 1069, 1075, 1079)

10 minutesLow riskThe code is 1068, 1069, 1075 or 1079.

These codes mean the service itself is fine but something it needs is not: a service it depends on, or the account it starts with. The service's Properties window shows both.

1. In services.msc, double-click the service from the event and open the Dependencies tab.
2. Read the list under This service depends on the following system components. Check that each one is not Disabled and starts by hand.
3. If a dependency is disabled, set it back to its default type as in Fix 2. If it is missing (code 1075), go to Fix 6.
4. Open the Log On tab of the service. Built-in Windows services start as Local System account or as a built-in account such as Local Service.
5. If someone changed it to a user account, set it back to what the same service uses on another Windows PC, select OK and restart.

Command Prompt or PowerShell: startup type, account and dependencies of a service (replace WSearch with your service)

sc.exe qc WSearch

sc.exe qc prints START_TYPE, DEPENDENCIES and SERVICE_START_NAME (the account) in one place, which is quicker than the tabs when you check several services.

Fix 5. Repair or reinstall the program that owns the missing service (code 1060)

10 to 20 minutesLow riskThe code is 1060, or the service name in the event is not in services.msc at all.

Code 1060 means the component is still registered with DCOM but the service that should host it was removed. That happens when a program is uninstalled only partly, or when a debloat script deletes a service.

1. Search the web or your installed programs for the service name in the event to find which program it belongs to.
2. If the program is still installed, repair or reinstall it. Most programs offer Modify or Repair in Settings > Apps > Installed apps.
3. If you removed the program on purpose and do not miss it, the rows are leftovers and harmless.
4. If the name is a Windows service, it should not be missing. Go to Fix 6.

Repair or reset an app: How to repair or reset an app in Windows Remove a program completely: Uninstall a program or app in Windows

Fix 6. Repair Windows system files with DISM and SFC

15 to 30 minutesNo riskA built-in service is set correctly and still fails, or a Windows service is missing (codes 1060 and 1075).

If the files of a Windows service are damaged, the service can fail at start whatever its settings are. DISM restores the component store and SFC replaces damaged system files from it.

1. Open an elevated command window. Right-click Start and select Terminal (Admin), or type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.
2. Run DISM first. Type the command below and press Enter. DISM downloads clean copies of damaged components from Windows Update, so it can take several minutes. Wait until it says The operation completed successfully.

   DISM.exe /Online /Cleanup-Image /RestoreHealth

3. Run System File Checker. In the same window, type the command below and press Enter. Do not close the window until the verification reaches 100%.

   sfc /scannow

4. Read the result and restart. Compare the last message with the table below this guide, then restart the PC so that repaired files are loaded.

These steps were written for Windows 11 24H2 and 25H2. The full page with the other versions and what each result means: Run DISM and SFC to repair Windows system files

If DistributedCOM 10005 keeps coming back: what to check and what to collect

If the same code and service still fail after the matching fix, check that DCOM itself is running and collect the details below before you ask Microsoft or the program's maker for help.

• The DCOM services. In services.msc, DCOM Server Process Launcher, Remote Procedure Call (RPC) and RPC Endpoint Mapper must show Running and Automatic. Do not change them.
• DCOM is turned on. Press Win + R, type dcomcnfg and press Enter. Open Component Services > Computers, right-click My Computer, select Properties and open Default Properties. Enable Distributed COM on this computer should be ticked.
• The event XML. On the Details tab of the event, select XML View and copy it. It holds the code, the service and the server ID.
• The Windows version and build. Press Win + R, type winver and note both.
• What changed. Reliability Monitor (perfmon /rel) shows installs, updates and crashes day by day.

Event 10005 does not crash Windows. If a blue screen and 10005 rows have the same time stamp, the crash came first and the service failed because Windows was going down, which is what code 1115 says.

How to keep DCOM 10005 errors away

Frequently asked questions

What is DistributedCOM error 10005?

It is an Event Viewer entry from the source DistributedCOM with Event ID 10005. Windows writes it when a program asks for a DCOM component that lives in a service, and that service fails to start. The text is DCOM got error, a code in quotes, attempting to start the service, and the service name. The code is a standard Windows system error code that says why the start failed. Code 1058 means the service is disabled, 1053 that it was too slow, 1115 that Windows was shutting down.

Is event ID 10005 dangerous?

Usually not. It is a log entry, not a crash, and Windows does not show it on the desktop. Rows with code 1115 during a shutdown and 1084 in Safe Mode are expected. It matters only when the same service fails at every start and a feature that needs it is broken, such as search or Windows Update. Nothing in Microsoft's documentation ties the event to malware, so a virus scan will not change it. Read the code with Fix 1 before you change anything.

Can DistributedCOM 10005 cause a blue screen?

No. The event only records that a service did not start. A blue screen has its own entries: BugCheck 1001 with the stop code, and Kernel-Power 41 or EventLog 6008 after the restart. If you see 10005 rows next to a blue screen, check their code. Code 1115 means Windows was already shutting down, so the crash came first. Look for the cause of the crash in those other events and in the dump files in C:\Windows\Minidump, not in the DCOM rows.

How do I fix DistributedCOM 10005 on Windows 11?

The steps are the same as on Windows 10. Open Event Viewer, go to Windows Logs, System, filter by 10005 and read the code in quotes. If it is 1058, open services.msc, find the service and set its startup type back from Disabled to its default. If it is 1053, restart the service and do a clean boot to find what delays it. Codes 1115 and 1084 need nothing. Windows 11 only moves some Settings pages, which Fix 3 gives for both versions.

What does DCOM got error 1058 mean?

Code 1058 is Microsoft's ERROR_SERVICE_DISABLED: "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it." In event 10005 it almost always means the service's startup type is set to Disabled. Something asked DCOM for a component inside that service, and Windows refused to start it. Set the startup type back to its default in services.msc, as Fix 2 shows. If you disabled the service on purpose, the rows are the expected result.

What does DCOM got error 1115 mean?

Code 1115 is "A system shutdown is in progress." A program asked for a service while Windows was already shutting down or restarting, so Windows did not start it. The rows sit in the last seconds before the shutdown and often name wuauserv, TrustedInstaller or SecurityHealthService. Users on Microsoft Q&A and Windows forums report them on healthy PCs. You can ignore them. They only matter if the PC shuts down when you did not ask it to, and then the cause is elsewhere.

Why does event 10005 name WSearch?

WSearch is the short name of the Windows Search service, which builds the index for searches in Start and File Explorer. Many parts of Windows ask for it, so it shows up in 10005 rows more often than most services. With code 1058 someone disabled it, often to stop indexing; set it back to Automatic (Delayed Start). With code 1053 it started too slowly; restart it and rebuild the index as in Fix 3. The earlier version of this page also changed search suggestion policies, which do not affect this event.

What is event ID 10005 in other logs or programs?

This page is about Event ID 10005 from the source DistributedCOM in the Windows System log. Other programs use the same number for unrelated errors. A message such as an untrusted resource error 10005 with a wrong API key comes from a specific app or service and has nothing to do with DCOM. Check the Source column in Event Viewer. If it is not DistributedCOM, look for help from the maker of that program instead.

I see this error in another language. Is it the same?

Yes. Event Viewer translates the text with Windows, but the Event ID 10005, the source DistributedCOM and the code in quotes stay the same. Searches such as ошибка 10005 windows 10 in Russian describe the same event, with the same codes and the same fixes. Read the number in quotes and use the table in the section on codes. This page is in English, but every command and path in it works the same on a Windows in another language.

Should I turn on Enable Distributed COM on this computer?

It should already be on, and on a normal Windows PC it is. You find it with dcomcnfg, under Component Services, Computers, My Computer, Properties, on the Default Properties tab. If it is cleared, tick it, select OK and restart, because many Windows parts use DCOM. Turning it on or off does not remove the 10005 rows of a disabled or slow service, though. The code in the event still decides the fix, so start with Fix 1.