An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {45FB4600-E6E8-4928-B25E-50476FF79425}

Question

I'm getting the following error message in Azure Windows 10 Application Event log periodically:

An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {45FB4600-E6E8-4928-B25E-50476FF79425} was rejected

Windows version is 21H1 OS Build 19043.1387.

I saw the same report dated December 13, 2013, on an MSDN forum but no solution since that.

Here is the XML view of the report.

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-COMRuntime" Guid="{bf406804-6afa-46e7-8a48-6c357e1d6d61}" EventSourceName="COM" /> 
  <EventID Qualifiers="0">10031</EventID> 
  <Version>0</Version> 
  <Level>2</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8080000000000000</Keywords> 
  <TimeCreated SystemTime="2021-11-29T12:34:18.1932644Z" /> 
  <EventRecordID>27780</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="5708" ThreadID="1852" /> 
  <Channel>Application</Channel> 
  <Computer>hw2.masiutin.com</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data>{45FB4600-E6E8-4928-B25E-50476FF79425}</Data> 
  </EventData>
  </Event>

How can I fix this problem and/or prevent this error from appearing in the log?

This error goes all the way back to 2016 - that process will be MonitoringHost.exe - and MSFT *still* haven't fixed it. Apparently it's a false alert if SCOM or whatever is still functioning OK. https://social.msdn.microsoft.com/Forums/en-US/325ab240-5eff-4a4b-9f5b-2eaf2a4002ed/an-unmarshaling-policy-check-was-performed-when-unmarshaling-a-custom-marshaled-object-and-the-class?forum=systemcenterservicemanager — LeeM, Jan 16 '23 at 23:28

score 1 · Answer 1 · edited Jan 10 '22 at 21:16

Here's a possible fix for your error:

1.Start by identifying which process or service is triggering this error.

2.Check Task Manager for the process ID 5708 (in the above sample, but will probably be different when you go back to check).

3.Check which identity that process or service is running as. Task Manager will also show you this in the User column. If it is a service, you can check Service Manager to see which identity it is configured to run as.

4.Once you have identified the user or service account that this process uses, make a note of it and head to Registry Editor.

5.Search the registry for the class GUID. For each instance found, change the permissions to grant the above service account and the SYSTEM identity FULL privilege to the key and its subkeys. (I have seen suggestions to add Administrators here as well, but it's best to target this to the specific service account, if possible.)

6.Once your process identity has permissions on the class key[s], reboot the system, and it should be resolved.

Similar posts, if you want to compare notes:

[1] - https://www.tenforums.com/general-support/108499-event-id-10031-a.html

[2] - https://social.technet.microsoft.com/Forums/en-US/325ab240-5eff-4a4b-9f5b-2eaf2a4002ed/an-unmarshaling-policy-check-was-performed-when-unmarshaling-a-custom-marshaled-object-and-the-class?forum=systemcenterservicemanager

An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {45FB4600-E6E8-4928-B25E-50476FF79425}

1 Answers1