A COM+ Client That Uses a Proxy May Receive a "Permission Denied" Error Message (800A0046) When CLB Is Used on a Computer That Is Running Microsoft Windows Server 2003

Article translations Article translations
Article ID: 820440 - View products that this article applies to.
This article has been archived. It is offered "as is" and will no longer be updated.
Expand all | Collapse all

SYMPTOMS

Your client application may try to create an object that uses Component Load Balancing (CLB) on a computer that is running Windows Server 2003. If that object has a proxy with a remote server name that points to the Application Center 2000 routing cluster virtual IP (VIP) that is installed on the client computer, you may receive the following error message:

Permission Denied

CAUSE

By default, COM+ application access checks are turned on in Windows Server 2003. This is done to help increase the security and may help to prevent anonymous users from creating objects on the Windows Server 2003 COM+ application servers. CLB uses the anonymous account to create objects for client computers that use proxies to point to the routing cluster.

RESOLUTION

You can resolve this issue by using one of the following methods:
  • Method 1

    You can create a role to permit access and to add the NT AUTHORITY\ANONYMOUS LOGON account or the NT AUTHORITY\NETWORK group to the role. For each component that is load balanced, click to select the role on the Security tab. This permits you to set the access on a per component basis
  • Method 2

    You can restore the Microsoft Windows 2000 setting if you click to clear the Enforce access checks for this application check box on the property sheet of the component in the Component Services snap-in. You must do this for all load balanced applications that must be accessed by clients that use proxies to point to the CLB routing cluster. This permits access to all components in the application.

STATUS

This behavior is by design.

MORE INFORMATION

You can enforce security roles on COM+ method calls. You can do this to help prevent users from using the objects that they create if their account does not have an appropriate role.

REFERENCES

For additional information about creating roles in COM+, click the following article number to view the article in the Microsoft Knowledge Base:
326818 PRB: MTS and COM+ Roles Are Not Applied Immediately

Properties

Article ID: 820440 - Last Review: February 27, 2014 - Revision: 1.3
APPLIES TO
  • Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
  • Microsoft Windows Server 2003, Standard Edition (32-bit x86)
  • Microsoft Windows Server 2003, Web Edition
  • Microsoft Application Center 2000 Service Pack 2
Keywords: 
kbnosurvey kbarchive kbprb KB820440

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com