Retrieve DCOM Errors from the Event Log

Get-DComErrors.ps1

function Get-ComNameByAppId {
    param (
        [Guid] $AppId
    )
     (get-wmiobject -class "Win32_DCOMApplication" -namespace "root\CIMV2" -Filter "AppID = '{$AppId}'").Name
}

Get-EventLog -EntryType Error -LogName System |Where EventID -eq 10016 | % {
    $ReplamentStringLength = $_.ReplacementStrings.Length;
    $ClassId = $null;
    $AppId = $null
    $Name = $null
    if ($ReplamentStringLength -ge 5) {
        $ClassId = [Guid]$_.ReplacementStrings[3]
        $AppId = [Guid] $_.ReplacementStrings[4]
        $Name = Get-ComNameByAppId $AppId
    }
    else {
        Write-Warning 'EventId $_.EventId does not appear to be a normal COM error'
    }

     

    New-Object 'PSObject' -Property @{
        EventId = $_.EventId;
        Message = $_.Message;
        ClassId = $ClassId;
        AppId = $AppId;
        Name = $Name
    };
} | Export-Csv -Path $env:USERPROFILE\Desktop\BrokenComObjects.csv