Distributed Component Object Model

Distributed Component Object Model (DCOM) is a network extension of the Component Object Model (COM), which enables interprocess communication across a network.

  • Before you begin, see Checklist: Configuring DCOM.
  • For help with specific tasks, see How to.
  • For general information about DCOM, see Concepts.
  • For problem-solving instructions, see Troubleshooting.


Checklist: Configuring DCOM

The following checklist identifies tasks to perform before starting the program Distributed COM Configuration Properties.

Step | Reference
Identify the application that you want to configure:________________________. | Network administrator and developer
If the program is a COM server program, identify the computer on which the program is installed: ________________________. | Network administrator and developer
If the program is a COM client program, identify and list the users that can start distributed COM client programs: ________________________. | Network administrator and developer
Identify the DCOM properties that need to be configured:
  • Application start _________________.
  • User access permissions_____________________.
 Network administrator and developer


How to...

  • Set default permissions for all DCOM programs
  • Set location of a DCOM program
  • Set user accounts that can start a DCOM program
  • Set custom permissions for a specific DCOM program
  • Add a user or group to the DCOM permissions list
  • Set special access configuration permissions for DCOM programs
  • Disable DCOM


Set default permissions for all DCOM applications

To set default permissions for all DCOM applications

  1. Open Distributed COM Configuration Properties.
  2. Click the Default Security tab.
  3. Under Default Access Permissions, Default Launch Permissions, and Default Configuration Permissions, Click Edit Default to set default permissions.
  4. If necessary, click Add to add other user accounts to Name list box.
  5. In Name, select the user or group whose default permissions you want to change.
  6. In Type of Access, select an access type for the selected user or group.

Notes

  • To start Distributed COM Configuration Properties, click Start, click Run, and then type dcomcnfg.
  • To customize configuration permissions, in the Registry Key Permissions dialog box, under Type of Access, click Special Access.

Related Topics


Set the location of a DCOM program

To set the location of a DCOM program

  1. Open Distributed COM Configuration Properties.
  2. On the Applications tab, click the program you want to configure, and then click Properties.
  3. Click the Location tab, and specify the location of the program. To run the application on a computer other than the current computer or the computer where the data is located, click Run application on the following computer and enter the NetBIOS name of the computer on which to run the application.

Note

  • To start Distributed COM Configuration Properties, click Start, click Run, and then type dcomcnfg.


Set user accounts that can start a DCOM program

To set user accounts that can start a DCOM program

  1. Open Distributed COM Configuration Properties.
  2. Click the program you want to configure, and then click Properties.

  3. Click the Identity tab, and click the user account that will be used to run the program.

    To allow the program to be run by a user other than the interactive user or the user who launches the application, click This user and type the user information in the boxes below.

Notes

  • To start Distributed COM Configuration Properties, you can also click Start, click Run, and then type dcomcnfg.
  • This procedure enables the account you identify to start processes and access resources on other computers in the domain. If the program is installed as a service, you can run the program by identifying the built-in system account or a service account that you create in this procedure.

Related Topics


Set custom permissions for a specific DCOM program

To set custom permissions for a specific DCOM program

  1. Open Distributed COM Configuration Properties.
  2. On the Applications tab, click the program you want to configure, and then click Properties.
  3. Click the Security tab, click Use custom access permissions, Use custom launch permissions, or Use custom configurations permissions as appropriate, and then click Edit.
  4. If necessary, in the Registry Value Permissions dialog box, click Add to add other user or group accounts to Name.
  5. In Name, click the user or group whose permissions you want to set.
  6. In Type of Access, select an access type for the selected user or group.

Notes

  • To start Distributed COM Configuration Properties, click Start, click Run, and then type dcomcnfg.
  • To customize configuration permissions, in the Registry Key Permissions dialog box, under Type of Access, click Special Access.

Related Topics


Add a user or group to the DCOM permissions list

To add a user or group to the DCOM permissions list

  1. Open Distributed COM Configuration Properties.
  2. Click the Default Security tab.
  3. In Default Access Permissions click Edit Default.

    Or, in Default Launch Permissions, click Edit Default.

  4. In Registry Value Permissions, click Add.
  5. In the Names list box, click the users or groups, and then click Add.
  6. If necessary, select a permission in Type of Access.
  7. If necessary, use Names to add accounts to the permissions list.
    • To add an entire group, click the group and click Add.
    • To see all the users on a selected computer or domain, click Show Users.
    • To see the contents of a selected group, click Members.
    • To add only some members of a group, click the members in either of the Group Membership dialog boxes, and then click Add.

Notes

  • To add users and groups to the default permissions list for all applications, in Distributed COM Configuration Properties, click the Default Security tab and then click Edit Default.
  • To add users and groups to the permissions list for one application, in Distributed COM Configuration Properties, click the Application tab, click Properties, and then click the Security tab.
  • If you do not know the domain of the user or group, click Search in the Add Users and Groups dialog box.
  • The List Names From box controls which computer or domain accounts will be displayed in the Names list box. To select users from another computer or domain click the appropriate domain in the List Names From box .
  • Domains appear only if your computer belongs to a Windows 2000 domain. The domains shown have a trust relationship with the current domain.


Set special access configuration permissions for DCOM programs

To set special access configuration permissions for DCOM programs

  1. Open Distributed COM Configuration Properties.
  2. Click the Default Security tab, under Default Configuration Permissions click Edit Default.
  3. In Registry Key Permissions in Type of Access, click Special Access.
  4. In the Special Access dialog box, click the type of control you want to assign to the selected user or group:
    • To assign Full Control, click Full Control (All).
    • To customize special access, click Other, and then click the types of access that you want to assign.
    • To enable the user to read a value entry from the registry key, click Query Value.
    • To enable the user to set value entries in the registry key, click Set Value.
    • To enable the user to create subkeys on the registry key, click Create Subkey.
    • To enable the user to identify the subkeys of the registry key, click Enumerate Subkeys.
    • To enable the user to audit notification events from the key, click Notify.
    • To enable the user to create a symbolic link in the key, click Create Link.
    • To enable the user to delete the key, click Delete.
    • To enable the user to gain access to the key for the purpose of writing a discretionary ACL to the key, click Write DAC.
    • To enable the user to gain access to the key for the purpose of taking ownership of it, click Write Owner.
    • To enable the user to gain access to the security information on the key, click Read Control.

Notes

  • To start Distributed COM Configuration Properties, click Start, click Run, and then type dcomcnfg.
  • Special access is available only when assigning configuration permissions.
  • For information about using Registry Editor, see Related Topics.

Related Topics


Disable DCOM

To disable DCOM

  1. Open Distributed COM Configuration Properties.
  2. Click the Default Properties tab.
  3. Clear the Enable Distributed COM on this computer check box.

Notes

  • To start Distributed COM Configuration Properties, click Start, click Run, and then type dcomcnfg.
  • You can disable DCOM for a specific program by denying access or start permissions to the built-in network user account. To do this, click the Applications tab, click the program, click Properties, and then click the Security tab. Click Use custom access permissions or Use custom launch permissions, and then click Edit.


Concepts

This section covers:

  • Configuring programs to use DCOM


Configuring programs to use DCOM

Distributed component object model (DCOM) is an extension of Component Object Model (COM) technology. DCOM supports communication between objects on different computers on a network by handling low-level details of network protocols. This enables use of distributed programs consisting of multiple processes working together to accomplish a single task. First delivered in Windows NT 4.0, Service Pack 4, COM Internet Services (CIS) provides additional support that enables DCOM use over the Internet (using HTTP) when other protocols cannot be used due to a firewall on the server side or a proxy server on the client network.

To configure 32-bit COM and DCOM programs, you must use the Distributed COM Configuration Properties utility to set program properties, such as security and location. On the computer running the client application, you must specify the location of the server program that will be accessed or started. On the computer running the server application, you must specify the user accounts that will have permission to access or start the program.

For information about using the Distributed COM Configuration Properties utility, see How to.


Troubleshooting

Troubleshooting DCOM is primarily a matter of troubleshooting program configuration and the deployment. Because DCOM involves programs running on multiple computers, the potential troubleshooting issues are greater than when using COM on a single computer. The additional problems you may need to address include security between programs and network protocols.

Because COM security is turned on by default, security checks are started whenever a COM object is started by a COM program or a client program tries to access the COM object.

Protocols

If multiple protocols are configured, DCOM attempts to use them in the order in which they appear in the DCOM protocol list.