Querying the System log through PowerShell's Get-WinEvent with a provider and event-ID filter surfaced repeated DistributedCOM 10010 timeouts naming one CLSID. Mapping that CLSID to an app package manifest identified a third-party cloud-files context-menu handler as the cause of a right-click hang, after several restart-based guesses had failed.
- What worked
- FilterHashtable queries (LogName, ProviderName, Id, StartTime) were fast, and grouping by the CLSID in event properties gave a clean count and timeline that matched the user's test times.
- What got in the way
- The 10010 message names only a CLSID, not the owning app; finding the owner required searching installed package manifests separately.