What do the different DCOM / COM security settings mean?

permissions com opc dcom opc-da
Justin picture Justin · Oct 19, 2012 · Viewed 17.7k times · Source

Our application uses COM and DCOM extensively, and so as part of that we need to ensure that the COM security permissions are correctly set up. I know that I can access these permissions under the Component Services MMC snap in and that I can set the defaults / limits under the property pages for the Computer

Screenshot of the My Computer property pages

And that under the DCOM Config node I can drill down and set securty permissions for individual applications

Screenshot of the Logger application property pages

I also understand the relationship between the "Defaults" (what DCOM applications will use unless permissions are expicily set on a per-application basis), "Limits" (what permissions will be enforced even if per application settings exceed these settings), however I don't understand (and can't find any documentation) on the difference between the different settings that I can set

  • Whats the difference between "Access", "Launch", "Activation" and "Configuration" permissions?
  • Do these settings affect COM applications, or only DCOM applications?
  • If using remote DCOM do I need to set permissions on both the server and the client, or just the client?
  • Is there any documentation which explains the above?

Answer

Roman R. picture Roman R. · Oct 19, 2012

The settings on the security tab is the per-AppID security configuration on registry, and you will find more information on MSDN on this in AppID Key:

AccessPermission Describes the Access Control List (ACL) of the principals that can access instances of this class. This ACL is used only by applications that do not call CoInitializeSecurity.

LaunchPermission Describes the Access Control List (ACL) of the principals that can start new servers for this class.

When a COM client attempts to access COM server, COM subsystem checks client side credentials against these access lists and decides whether to allow access to server, and if server is not yet started, whether to allow its start. Hence, the two lists - for regular access and for new server launch (should it be necessary).

Note that these are per-application settings. Specific classes should have CLSID to APPID mappings on the registry to be properly associated.

Related questions

How to Register a COM Object for All Users

I use regsvr32 MyCOM.dll to register my com object for my application. This works fine under my admin account. if a switch the user to a non admin, the program fails. It seems that the COM object is not …

Read More
How to change permissions for a folder and its subfolders/files in one step?

I would like to change permissions of a folder and all its sub folders and files in one step (command) in Linux. I have already tried the below command but it works only for the mentioned folder: chmod 775 /opt/lampp/…

Read More
Chmod 777 to a folder and all contents

I have a web directory /www and a folder in that directory called store. Within store are several files and folders. I want to give the folder store and all files and folders within the store folder all permissions. How …

Read More