DCOM：CoCreateInstanceEx 返回 E_ACCESSDENIED
我正在两台计算机上使用服务器和客户端开发 DCOM 应用程序，这两台计算机都运行带有 Service Pack 2 的 WinXP。在两台计算机上，我使用相同的用户名和密码登录。
当一台机器上的客户端调用CoCreateInstanceEx，要求另一台机器启动服务器应用程序时，它返回E_ACCESSDENIED。
我尝试进入 dcomcnfg 中服务器应用程序的组件属性，并向每个人授予所有操作的完全权限，但这没有帮助。
我需要做什么才能让此调用成功？
更新：当服务器应用程序在 Windows 2000 机器上运行时，我不会收到此错误； CoCreateInstanceEx 返回 S_OK。
I'm working on a DCOM application with the server and client on two machines, both of which are running WinXP with Service Pack 2. On both machines, I'm logged in with the same username and password.
When the client on one machine calls CoCreateInstanceEx, asking the other machine to start up the server application, it returns E_ACCESSDENIED.
I tried going into the server app's component properties in dcomcnfg and giving full permisions to everyone for everything, but that didn't help.
What do I need to do to allow this call to succeed?
Update: When the server app is running on a Windows 2000 box, I do not get this error; CoCreateInstanceEx returns S_OK.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
顺便说一句，您的 Windows 2000 机器是什么风格？ Professional、Server、Adv Server...
另外，两者之间的域成员资格是否有区别（一个在域上，另一个不在域上，不同的域等...？）
还有一件事 - DCOM 错误将出现在有时系统事件日志 - 特别是对于对象创建 - 您是否在那里检查过线索？
What is the flavor of your Windows 2000 box, btw? Professional, Server, Adv Server...
Also, is there a difference between domain membership between the two (one on a domain, the other not, different domains, etc...?)
One more thing - DCOM errors will appear in the System event log at times - especially for object creation - did you check there for clues?
我有同样的问题。
该问题发生在装有 XP SP2+ 操作系统或更高版本的计算机上。
我使用以下步骤解决了这个问题：
验证客户端和服务器计算机是否位于同一域中。
您需要在两台计算机上使用相同的用户，或者，如果您想在客户端和服务器中使用不同的用户，您需要确保客户端和服务器用户在两台计算机上都具有权限（特别是 - 确保他们是分布式 COM 用户组的成员。
打开 Componenet 服务 MMC（运行 dcomcnfg）。
转到“我的”计算机 -> 属性 -> 默认属性并确保默认模拟级别为“识别”
确保您的应用程序的端口 135 中有防火墙例外。 ..
我希望这对您有帮助！
I had the exact same problem.
The problem happens in machines that have XP SP2+ OS or newer.
I solved it using the following steps:
Verify that both client and server computers are on the same domain.
You need to use the same user in both computers, or, if you want to use different users in client and server you need to make sure that both client and server users have privliges on both computers (in particular - make sure that they are members of Distributed COM users group.
open Componenet services MMC (run dcomcnfg).
Go to My Computer->Properties->Default Properties and make sure that Default Impersenation Level is "Identify"
Go to COM Security tab, in both in Access permissions and Launch and activation permissions go to Edit Limits, and add Local and Remote access permissions to the client and server users of your COM application
Make sure that you have a firewall exception in port 135 for your application...
I hope this helps you!
如果电脑不是同一域的成员，您还需要启动并启动它。 “匿名登录”的访问权限。 “大家”不包括这个。
If the PCs aren't both members of the same domain, you need to also given launch & access permissions to "ANONYMOUS LOGON". "Everyone" does not include this.
要检查三件事：
1) 返回 dcomcnfg 并尝试确保不仅访问安全性而且“启动权限”部分包含适当的安全用户或组。
2) 确保身份验证级别设置为“无”以外的其他值
3) 还要检查组件所在的磁盘位置是否确实可供您设置的安全权限中配置的帐户访问。
编辑：
还有一个：您也首先调用 CoInitialiseSecurity() 吗？ 这敲响了警钟！
EDIT2：
根据您的更新：尝试在两台 XP 计算机上完全删除防火墙，看看是否会产生影响。 您可能需要显式地让 DCOM 通过。
Three things to check:
1) Go back to dcomcnfg and make try making sure that not just the access security but also the "launch permissions" section contains the appropriate security users or groups.
2) Ensure that the Authentication Level is set to something else other than "None"
3) Also check that the location on disk that the component is located is actually accessible to the account configured in the security permissions you set.
EDIT:
One more: Are you calling CoInitialiseSecurity() first too? That rings a bell!
EDIT2:
Based on your update: Try dropping the firewalls completely on both XP machines and see if that makes a difference. You may need to let DCOM through explicitly.
是的，如果您的身份验证级别设置为默认。 默认设置中的身份验证级别设置为多少？ 只是出于兴趣。 （尽管它适用于 2000 盒子的事实可能会使这一点变得多余）
编辑：
另外：我似乎记得当我以前玩/使用 DCOM 时做了很多重新启动，所以当你对 dcomcnfg 设置感到满意也不会失败。
Right, so if your Authentication level is set to Default. What is the authentication level set to in the Default Settings? Just out of interest. (although the fact that it works to a 2000 box probably makes that redundant)
EDIT:
Also: I seem to remember doing a lot of rebooting when I used to play/work with DCOM so maybe a quick reboot of both machines when you're happy with the dcomcnfg settings wouldn't go amis either.