Re: DCOM Identity: This User

From: Alexander Nickolov (agnickolov_at_mvps.org)
Date: 06/23/04 

Date: Tue, 22 Jun 2004 21:55:38 -0700

Actually, I have a pretty good guess... Before your object's
settings are consulted, the activation request needs to come
through to the COM SCM. However, unless DCOM is globally
unsecured, your client has to actually go through basic network
security and obtain a logon token. Which means both the
global and the server DCOM settings must turn security off
in order for insecure DCOM to take place. 

-- 
=====================================
Alexander Nickolov
Microsoft MVP [VC], MCSD
email: agnickolov@mvps.org
MVP VC FAQ: http://www.mvps.org/vcfaq
=====================================
"John" <no@spam.com> wrote in message
news:eCFm$ZLWEHA.712@TK2MSFTNGP11.phx.gbl...
> Santhosh Pillai [MS] wrote:
>
> > Making the machine level Default Authentication Level to None (and
making
> > sure you do NOT set the Impersonation level to Anonymous) and adding
> > Everyone to Default launch & access is how you turn off the security.
You
> > have to do this on BOTH machines. A reboot is required after this
change.
> >
> > When you specify the user, you have to use MACHINENAME\USERNAME.
> >
>
> As you say, it works only if I set the machine defaults to these values.
> Can anyone tell me why it doesn't work if I set these same values to the
> object's AppId? I thought that the object values would override the
> machine defaults.
>
> The following are the object AppID settings:
>      RunAs: ASC21PLAIN\Autostructure
>      LaunchPermission:
>          Launch permitted to \Everyone
>          Launch permitted to NT AUTHORITY\SYSTEM
>          Launch permitted to NT AUTHORITY\NETWORK
>          Launch permitted to NT AUTHORITY\INTERACTIVE
>      AccessPermission:
>          Access permitted to \Everyone
>          Access permitted to NT AUTHORITY\SYSTEM
>          Access permitted to NT AUTHORITY\NETWORK
>          Access permitted to NT AUTHORITY\INTERACTIVE
>      AuthenticationLevel: None
>
> It only works if the machine defaults are set to:
> DCOM Settings:
>      DCOM Installed and Enabled
>      COM Internet Services: Not Enabled
>      Default Authentication Level: None
>      Default Impersonation Level: Identify
>      Additional Security for Reference Counting: Not Provided
>      COM Security Default Access Permissions:
>          Access permitted to \Everyone
>          Access permitted to NT AUTHORITY\INTERACTIVE
>          Access permitted to NT AUTHORITY\NETWORK
>          Access permitted to NT AUTHORITY\SYSTEM
>      COM Security Default Launch Permissions:
>          Launch permitted to \Everyone
>          Launch permitted to BUILTIN\Administrators
>          Launch permitted to NT AUTHORITY\INTERACTIVE
>          Launch permitted to NT AUTHORITY\SYSTEM
>      DCOM Protocols:
>          Connection-oriented TCP/IP
>          Connection-oriented SPX
>          Connection-oriented NetBEUI
>          Connection-oriented Netbios over IPX
>
> Thanks
>
> PS. I would also like to mention that the following KB article is wrong,
> the information is not correct and it should be updated:
> http://support.microsoft.com/default.aspx?scid=kb;en-us;266625

Relevant Pages

  • Re: DCOM Identity: This User
    ... settings are consulted, the activation request needs to come ... However, unless DCOM is globally ... security and obtain a logon token. ... COM Security Default Launch Permissions: ...
    (microsoft.public.win32.programmer.ole)
  • Re: Queries regarding DCOM Security Enhancements in Windows XP Service Pack 2
    ... server or for access to one of its methods is received by Windows XP SP2, ... DCOM applies the *most restrictive* security settings of those assigned to ...
    (microsoft.public.win32.programmer.ole)
  • Re: Lexmark Z35 in an XPSP2 home network using WinME clients
    ... (as well as other suggestiones including cleanly removing Lexmark drivers). ... > It's an issue with the DCOM communication interface. ... We did some investigation with DCOMCNFG and noticed that we ... the allow and deny settings for Remote Access were ...
    (microsoft.public.windowsxp.print_fax)
  • Re: messenger service
    ... Maybe someone can help with regard to Kerio Personal ... I played around with the settings so much, to solve the above problem, ... Event Source: EventSystem ... Unable to start a DCOM Server: ...
    (microsoft.public.win2000.security)
  • Re: Urgent:- Reading event log files using Win32_NTLogevent class
    ... The problem that you are have is with the connection string. ... following values change for different OSs and if the settings for Dcom ... Very few change dcom and com settings. ...
    (microsoft.public.win32.programmer.wmi)