Click here to get back home

Win2k3 SP1 security policy changes - COM dies after SP1 install

 HomeNewsGroups | Search | About
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
Win2k3 SP1 security policy changes - COM dies after SP1 install Peter E. Fry 08-01-2005
Posted by Peter E. Fry on August 1, 2005, 12:13 am
Please log in for more thread options
I searched around a bit for this, but didn't see any specific
mention. I have a Win2k3 installation -- a single server, in
production, so it can't be down for a reinstall. SP1 apparently killed
COM -- all sorts of components failed to start, but the only trace I
have is an unknown informational message from the COM system (my
security log rolled when I backed out the service pack).
At a guess, the new security behavior doesn't like my settings, but I
can't trace it to file system, registry, or local security policy. Gee,
MS wouldn't happen to have an add-only security template for SP1,
that'll add the minimum necessary security elements to start the OS?
It's tough to troubleshoot once the service pack is applied, because
half of the services, MMC snap-ins, and properties dialogs fail to
open. It's a bloody delicate house of cards, but at least it's a...
fairly robust house of cards.
I wouldn't expect file system or registry security, as I didn't make
significant changes to those (if any) -- but I did have a lot of fun
with the local security policy.
I also dug around on Microsoft's site, but didn't locate specific
information on the security changes -- just general info. I'd
appreciate any pointers or suggestions.

Peter E. Fry


Posted by Eric Eickhoff on August 12, 2005, 4:12 pm
Please log in for more thread options
Peter,

See if this helps:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cossdk/html/45297f03-7ff2-41c6-99cc-66ca1cc88569.asp

-Eric

>I searched around a bit for this, but didn't see any specific
> mention. I have a Win2k3 installation -- a single server, in
> production, so it can't be down for a reinstall. SP1 apparently killed
> COM -- all sorts of components failed to start, but the only trace I
> have is an unknown informational message from the COM system (my
> security log rolled when I backed out the service pack).
> At a guess, the new security behavior doesn't like my settings, but I
> can't trace it to file system, registry, or local security policy. Gee,
> MS wouldn't happen to have an add-only security template for SP1,
> that'll add the minimum necessary security elements to start the OS?
> It's tough to troubleshoot once the service pack is applied, because
> half of the services, MMC snap-ins, and properties dialogs fail to
> open. It's a bloody delicate house of cards, but at least it's a...
> fairly robust house of cards.
> I wouldn't expect file system or registry security, as I didn't make
> significant changes to those (if any) -- but I did have a lot of fun
> with the local security policy.
> I also dug around on Microsoft's site, but didn't locate specific
> information on the security changes -- just general info. I'd
> appreciate any pointers or suggestions.
>
> Peter E. Fry




Posted by Andrew Hayes on August 17, 2005, 12:53 pm
Please log in for more thread options
I'm having the same problems, but fortunately only in a test environment as
I like to test service pack installs before rolling them out, thanks to my
experiences with past screwed-up SP's. :-(

In our case, we use several COM components in our .NET web application and
they went belly up when I installed SP1 to the new W2K3 server. Up until
then things had been running smoothly.

I know that SP1 makes major changes to DCOM and COM+ (you can see some of
them in the extra Access, Launch and Activation Permissions checkboxes under
dcomcnfg) and that there have been FIVE post-SP1 rollup packages for COM+...

http://support.microsoft.com/default.aspx?scid=kb;en-us;897667

While I consider tightening security on remote component instancing a good
idea, our web application and COM components are all local to a single
server. It seems SP1 just uses a big brush to change the settings for all
components, whether they would be locally or remotely created.

Anyway, these articles have been beneficial to me in trying to untie the
COM+ mess, both from a system administration and a developer viewpoint:

http://support.microsoft.com/default.aspx?scid=kb;en-us;278013
http://support.microsoft.com/default.aspx?scid=kb;en-us;198432
http://support.microsoft.com/default.aspx?scid=kb;en-us;810153
http://support.microsoft.com/default.aspx?scid=kb;en-us;259615

I've cleared out several issues but am still left with the good old "Access
Denied" HRESULT when a VC++7 component is trying to enumerate the Task
Scheduler through it's COM interface.

There had been an associated DCOM event message for the "Machine Debug
Manager", but I cleared that one by following the instructions in:

http://support.microsoft.com/default.aspx?scid=kb;en-us;899965&sd=ee

It didn't stop the VC++7 component from failing though, and there is no DCOM
Config object for the Scheduling Agent Service Class. I gave appropriate
permissions to mstask.dll for IUSER and NETWORK SERVICE but still no luck.

If anyone has managed to use the Microsoft Task Scheduler from a VC++7 COM
component under Windows 2003 SP1, I would be very happy to hear from you!
:-)

Regards...Andrew




Similar ThreadsPosted
Re: How to install security configuration wizard December 30, 2005, 2:24 pm
Security Policy Can't be apply January 28, 2008, 11:37 pm
Domain Controller Security Policy August 12, 2005, 4:31 pm
Audit Policy (security logs) August 20, 2007, 10:18 pm
data security policy examples July 19, 2008, 7:05 pm
Accessing Local Security Policy Programatically August 3, 2006, 11:35 am
Local Security Policy "Effective Settings" September 1, 2006, 7:24 pm
Unable to Open Local Security Policy September 1, 2006, 7:26 pm
unable to view configuration from Local Security Policy June 21, 2005, 10:07 pm
Server refreshes its security policy with wrong values July 9, 2006, 8:29 am

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap