Configuring Distributed COM for IRISnGEN

The Communication Manager in IRISnGEN is now a registered system service, and as such, now has some administration requirements in order for it to be accessible from client workstations.  The security mechanisms in Microsoft Windows NT are designed to enable applications to selectively grant or deny certain users access to specific system services.  The administration of these system services is done though the Distributed COM Configuration tool, which is provided with Windows NT.  This tool can be accessed via the Start menu, by selecting the "Run…" menu option.  The name of the executable is DCOMCNFG.EXE, and when launched should present a screen as shown in Figure 1. It is recommended that the IRISnGEN Service not be running when altering the DCOM settings for the Communications manager.

Figure 1

Once the application has been loaded, locate the CommMgr application in the list, select it by clicking on it with the mouse, and press the "Properties…" button at the bottom of the window. The window in Figure 2 should appear.

Figure 2

The General tab contains the base information about the application.  The only configuration item available is the  Authentication level, which should be set to "Default".  

Figure 3

The Location tab contains information pertaining to which computer the application should be run.  This screen must be setup as shown in Figure 3, with only the "Run application on this computer" option checked.

Figure 4

The security tab, Figure 4, is where the configuration magic happens.  Access permissions control which users are allowed to access the Communications Manager. Select the "Use custom access permissions" radio button. The launch permissions control which users are allowed to start the Communications Manager if the application is not already running. Select the "Use custom launch permissions" radio button.  The final section, configuration permissions, can be left at the "Use default configuration permissions" setting.

Press the Edit button in the access permissions (top) section  The editor is shown in Figure 5.

Figure 5

This screen controls which users have access to the service. If you wish to tightly control which users have access to Remote Agent Management, this is the place.  Any existing accounts located in this list can be left in place. If the Everyone group is not present, add it to the list now by using the "Add…" button and picking it in the user selection dialog (not pictured). Press the "OK" button to save your configuration settings and continue administering the application.

Press the Edit Button in the launch permissions section, the editor is shown in Figure 6.

Figure 6

The only user account that should be located in this list is the user under which the IRISnGEN Service is running, which can be found in the Windows NT service control manager.  It is *extremely* important that this match what is in the service settings, otherwise clients will not be able to access the Communications Manager.  Add it to the list now by using the "Add…" button and picking it in the user selection dialog (not pictured). If there are other users listed in this window, delete them, leaving only the user under which the IRISnGEN service is running.

IMPORTANT NOTE: The user specified in the above section must have certain advanced rights associated with it before the system will work correctly. The user must have the "Log on as a Service" and "Log on as a Batch Job" right assigned to them from local security policy editor (see Figure 7 below).  This editor can be found in the User Manager application in Windows NT 4.0 or the Local Security Policy application under the Administrative Tools menu in Windows 2000. Please consult the Windows Help file for instructions on changing local security policies.

Figure 7

Figure 8

The Identity tab is the final tab we will be modifying, and is pictured in Figure 8.  As in the previous screen, the user account that the application runs as, must be the same as the user account under which the IRISnGEN Service runs.  Select the "This user" radio button and browse the list for the appropriate user.  Supply the correct password and confirm it.

Press the OK button twice to save the configuration settings and exit the application.

Start the IRISnGEN service.