Windows 10 randomly freezes for 15–30 seconds during file operations – Repeated DistributedCOM Event ID 10010.

Capture a Windows Performance Recorder trace during a freeze before changing DCOM permissions or registry entries, because Event ID 10010 records a COM activation timeout but does not establish that the timed-out server caused the Explorer delay.

What the event currently establishes

• The CLSID identifies a COM class. Its registration can point to an executable through LocalServer32, a DLL through InprocServer32, or an associated AppID/service. ^1^
• An out-of-process COM server must register its class object within a time window—60 seconds by default—or COM reports a timeout. ^2^
• Microsoft’s Windows 10 22H2 release-health information does not document a known freeze issue tied to this CLSID and Event 10010. ^3^
• A non-Microsoft registry example associates this GUID with an AskM365Copilot context-menu component, but that is not authoritative identification for your PC. Confirm the local owner instead. ^4^

A shell extension is a plausible investigation target because these COM DLLs load into Explorer, and a hung extension can hang Explorer. Copy hooks can also run during move, copy, delete, or rename operations. ^5^

1. Identify the CLSID locally

Run this read-only PowerShell script; it does not modify the registry:

$clsid = '{[GUID]}'
$paths = @(
 "Registry::HKEY_CURRENT_USER\Software\Classes\CLSID\$clsid",
 "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\$clsid",
 "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\$clsid"
)
foreach ($path in $paths) {
  if (Test-Path $path) {
    "`nFOUND: $path"
    Get-ItemProperty $path | Format-List *
    Get-ChildItem $path | ForEach-Object {
      Get-ItemProperty $_.PSPath | Format-List PSChildName, '(default)', *
    }
  }
}

Inspect the results for:

• InprocServer32: DLL loaded into a host such as Explorer.
• LocalServer32: executable COM server.
• AppID or LocalService: associated application or service.
• The default value or ProgID: descriptive component name.

COM checks per-user registration before computer-wide registration, so both locations matter. ^6^

If nothing appears, do not conclude that the event is invalid or unrelated. Packaged/MSIX applications can use manifest-based COM registration rather than only the conventional CLSID locations; inspect installed packages or their manifests for the GUID. ^7^

2. Capture the actual freeze with WPR

Your disk measurements already rule out obvious sustained saturation, so capture thread waits, RPC/COM activity, drivers, and I/O latency instead.

1. Install the Windows Performance Toolkit from the Windows ADK if Windows Performance Recorder and Windows Performance Analyzer are not installed.
2. Open Windows Performance Recorder as administrator.
3. Select More options.
4. Set:
   • Performance scenario: General
   • Detail level: Verbose
   • Logging mode: Memory
5. Select Start, work normally, and reproduce one freeze.
6. As soon as the system recovers, select Save, record the exact freeze time, and save the ETL file. Microsoft specifically recommends leaving the General profile running until an unpredictable transient issue occurs. ^8^

In WPA:

1. Open the ETL and choose Trace → Load Symbols.
2. Zoom into the 15–30-second freeze interval.
3. Add Computation → CPU Usage (Precise).
4. Filter New Process to explorer.exe.
5. Arrange by process, thread, and stack; sort by Wait (Max) and then Wait (Sum).
6. Follow the longest wait’s readying thread/process. Also inspect Disk Usage, DPC/ISR, and Generic Events for COM/RPC activity.

WPA’s precise CPU view supports wait analysis by process, thread, readying process, and stack. ^9^

Compare the trace with Event 10010, including the interval before the event timestamp: the event may be written when activation finally times out, not when the visible pause begins. Timestamp proximity strengthens the hypothesis; confirmation requires the affected Explorer/UI thread to be waiting on the identified COM/RPC path.

3. Isolate background software conditionally

If the trace implicates a third-party shell extension, updater, antivirus filter, cloud client, or other background component, disable or uninstall that specific component first.

If the trace is inconclusive, perform a clean boot:

1. Run msconfig.
2. Services → Hide all Microsoft services → Disable all → Apply.
3. Startup → Open Task Manager, disable enabled startup items, and restart.
4. If freezing stops, re-enable half the items at a time until the offender is isolated.
5. Restore normal startup afterward with msconfig → General → Normal startup, re-enable services and startup items, and restart. ^10^

Do not apply Event 10016 “Local Activation permission” registry fixes to this Event 10010 case. Avoid deleting the CLSID or changing DCOM permissions unless the trace and local registration identify the component and its vendor provides that exact repair.

References

1. CLSID Key
2. LocalServer32
3. Windows 10, version 22H2 known issues and notifications
4. 2026-10-19_Block-Ask-M365-Copilot-Context-Menu.reg
5. Working with Shell Extensions
6. Classes and Servers
7. com4:InProcessServerClassReference
8. Recording for Basic System Diagnosis
9. Troubleshoot processes and threads by using WPR and WPA
10. [Windows 10](https://support.microsoft.com/windows/experience/startup-boot/how-to-perform-a-clean-boot-in-windows)