Stuck in DCOM limbo

[Muddmuse]

We've recently done an in-place upgrade our IIS server from WinNT to 2000 and a clean install of Win2003 on our MTS server. After the upgrade DCOM calls are failing producing the following error on the IIS box:

006~ASP 0177~Server.CreateObject Failed~Unspecified Error

Searches on MSDN has mostly turned up issues with permissions which we've double checked and appear to be fine. Identity settings also appears to be correct. We've created a test harness vbs on the IIS box and that executes fine. We only get the error when running though IIS. Any suggestions on where to proceed?

 

[palbano]

I have no specific information other than to point out that the default security settings on all Server software from MS after NT4 etc. has been increased. In fact in the most recent releases I believe you can consider things to be locked down. So it is very likely that you are still need to adjust security settings on one of more of your Server components.

-pete

 

[jcasetnl]

The problem with DCOM is that when it breaks it doesn't give you very useful information for fixing the problem. This is partially for security reasons, but it doesn't make your life any easier.

A couple tips though: when you change permissions, make sure you are killing your dllhost processes as any existing instances will retain whatever security context they had when they were instantiated. People often change permissions and then test and get the same results. It's only till they head off to lunch or leave for the day and the instance times out on its own, that the new instance "works", leading to a lot of the dcom voodoo people complain about.

Second, try unregistering your objects on both client and server, reboot, and re-register. Make sure either you've got the IUSR account on both boxes or that the appropriate trusts, etc are in place.

Lastly, if your object performs a priveledged operation (say, writing to the event log, for example) the "Run As" user must have the appropriate priveledges (in this case, it must be power user or administrator).