Programs that use DCOM do not work correctly after you install Microsoft Windows Server 2003 Service Pack 1

After you install Microsoft Windows Server 2003 Service Pack 1 (SP1), programs that use DCOM do not work correctly. For example, if the server that you installed Windows Server 2003 SP1 on is also a backup server, Veritas Backup Exec 8.6 stops and cannot run backup tasks.

This issue occurs because the default Component Object Model (COM) permissions are changed in Windows Server 2003 SP1. The new COM permissions restrict remote calls that are not authenticated. The COM program may work locally, but the remote calls that are not authenticated fail. By default, only members of the Administrators group have the Remote Activation permission and the Launch permissions. This change prevents user accounts that do not belong to the Administrators group from starting COM components.

Before you follow the steps in this section that describe how to resolve this issue, you must first confirm that you are experiencing this permissions issue.

Confirm that you are experiencing this permissions issue

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

You can confirm that you are experiencing this permissions issue by turning on DCOM error logging. You can enable error logging by changing the registry and then restarting the DCOM process that you want to examine. The DCOM process that you want to examine determines whether you have to restart the computer. To turn on DCOM error logging, follow these steps:

1. Click Start, click Run, type regedit, and then click OK.
2. Locate the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole registry subkey.
3. Right-click the Ole value, point to New, and then click DWORD Value.
4. Type ActivationFailureLoggingLevel, and then press ENTER. Double-click ActivationFailureLoggingLevel, type 1 in the Value data box, and then click OK.
5. Right-click the Ole value, point to New, and then click DWORD Value.
6. Type CallFailureLoggingLevel, and then press ENTER. Double-click CallFailureLoggingLevel, type 1 in the Value data box, and then click OK.
7. Restart the DCOM program, and then examine the System log and the Application log for DCOM errors.

The error messages in the event log contain information that you can use to help resolve the permissions issue.

You can turn off DCOM error logging by changing the ActivationFailureLoggingLevel value and the CallFailureLoggingLevel value to zero.

Resolve the permissions issue

If you confirm that you are experiencing this permissions issue, resolve the permissions issue by following these steps:

1. Click Start, point to Administrative Tools, and then click Component Services.
2. Expand the Component Services\Computers container.
3. Right-click My Computer, and then click Properties.
4. On the COM Security tab, click Edit Limits in the Launch and Activation Permissions area or in the Remote Activation area. The area depends on where the issue occurs.
5. Click the account that is specified in the event log error, and then click Allow for the Remote Access permissions or for the Remote Launch and Remote Activation permissions.
6. Click OK two times to accept the changes. Then, try to use the program that uses DCOM.

This behavior is by design.

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the performance or reliability of these products.

For information about your hardware manufacturer, visit the following Web site: