Overview
Since the release of SP2 for WinXP and consequently Windows Vista / Windows 7, Windows has become a more tightly secured operating system than its predecessors. This requires additional steps when setting up a DCOM server such as the Enabler.
To use an XP, Windows Vista or Windows 7 system for an Enabler server, with clients on other computers, you need Enabler Pump Server version 3.1.10 or later (see software downloads). You also need to change some settings on the server computer.
This guide shows you the simplest configuration options which will result in a working system. If you aren't familiar with XP security settings then we recommend you follow it closely.
Obviously, more complex security setup is possible; feel free to adapt the security model to suit your requirements. Basically the following steps set up both global and Enabler-specific security settings to allow remote DCOM access (including activation on XP+SP2).
Most of the steps below were based on Windows XP, but are also applicable for both Windows Vista and Windows 7 unless otherwise noted.
Network Setup Wizard
The first step is to enable network access to the server by running the XP "Network Setup Wizard". Go to Start - Settings - Network Connections, then select "Set up a home or small office network" from the Network Tasks. On SP2 you can just go to Control Panel and select Network Setup Wizard.
Note: Each time you run the Network Setup Wizard on WinXP+SP2, the firewall is turned on (even if you have manually turned it off).
Server Firewall
The Windows firewall will prevent any Enabler clients from connecting. You can turn the firewall off on the server to set up a working system. The following section describes how to allow DCOM through a working firewall.
Using Windows Firewall Exceptions
The instructions that follow allow you to setup Firewall exceptions for DCOM, Enabler and SQL Server. First, Windows Firewall must be set to ON.
Click the 'Exceptions' tab and click the 'Add Port'. Type in "DCOM" for the name and "135" for the Port Number. Ensure that 'TCP' is selected. Click 'OK' to save.
After adding the port exceptions, Enabler's pump server must also be included to the list of program exceptions. On the same window click 'Add Program'. Browse and select "c:\enabler\psrvr.exe". Click 'OK' to save.
Additional Windows Firewall Exceptions for SQL Server
If SQL Server access is needed by the client, an exception port for SQL Server must be added. Type in SQL Server for the name, 1433 for the port number and select TCP.
Windows Vista and Windows 7 require that the 'File and Printer Sharing' also be ticked in the program exceptions.
Note: It is recommended that a working client-server be set up first with Windows Firewall OFF BEFORE turning it ON and adding exceptions.
Close the Windows Firewall afterwards.
User Configuration
The following settings require that the user who is logged on to the client computer, is configured as a user on the server. This applies to the Administrator account as well.
If the user isn't configured on the server, then you must also enable the Guest account on the server, and add the ANONYMOUS account to the account lists below. However we do not recommend that approach for security reasons.
NOTE: The Username and Password MUST be identical on both the Server and Client machines. The Password CANNOT be blank.
Guest accounts for Windows Vista and Windows 7
Windows Vista and Windows 7 NO longer grants access for Guest or ANONYMOUS accounts. This restriction was included for additional DCOM security.
Opening DCOM Configuration for The Enabler Pump Server
This configuration only needs to be done on the Enabler Server.
Open the Component Services Management Console, by selecting Start->Run then typing DCOMCNFG and pressing enter.
In the Component Services Window, expand the tree items:
Console Root
+ Component Services
+ Computers
+ My computer
+ DCOM Config
Right click the Enabler pump server entry and select Properties:
Changing DCOM Security on Windows XP or XP+SP1
In the 'Enabler pump server Properties' dialog, select the 'Security' tab.
You should see a dialog like the one shown here:
In the 'Access Permissions' area, select Customize and click Edit.
Ensure that "Everyone" is present in the list of names. If not, add it by clicking the Add button, typing "Everyone" and clicking OK.
Make sure Everyone has the Access Permission 'Allow' check box ticked.
Click OK to return to the 'Enabler pump server properties' window.
Configuration for Windows XP or XP with SP1 is now complete. Click OK to confirm the changes and Close the Component Services Window, then Restart the pump server.
Changing DCOM Security on Windows XP+SP2 (or later)
In the 'Enabler pump server Properties' dialog, select the 'Security' tab.
You should see a dialog like the one shown here:
In the Launch and Activation Permissions area, select Customize and click Edit.
Ensure that "Everyone" is present in the list of names. If not, add it by clicking the Add button, typing "Everyone" and clicking OK.
Tick the "Local Launch", "Local Activation" and "Remote Activation" Allow checkboxes. "Remote Launch" is not recommended.
Click OK to return to the 'Enabler pump server properties' window.
In the 'Access Permissions' area, select Customize and click Edit.
Ensure that "Everyone" is present in the list of names. If not, add it by clicking the Add button, typing "Everyone" and clicking OK.
Tick both the "Local Access" and "Remote Access" Allow checkboxes.
Configuring DCOM Limits (Security Limits)
WindowsXP Service Pack 2 introduced new system-wide limits on DCOM security. By default, these limits prevent remote Enabler clients connecting to an Enabler server running on WinXP+SP2. The Enabler requires that the remote client should be able to both access and activate (create) COM objects on the server. To change this setting follow the steps below:
In Component Services, Right click on My Computer and select Properties.
Select "COM Security" tab, and click the Edit Limits... button in the Access Permissions and Launch and Activation Permissions sections.
This is described in more detail below.
When you click Edit Limits... in Access Permissions you should see this dialog. Make sure that:
- Everyone is in the list; if not add it.
- Tick the Allow checkboxes for both Local Access and Remote Access for Everyone.
- Click OK to save any changes.
When you click Edit Limits... in Launch and Activation Permissions you should see this dialog. Make sure that:
- Everyone is in the list; if not add it.
- The Allow checkbox for Local Launch is checked.
- The Allow checkboxes for Local Activation and Remote Activation are both checked.
Then Click OK to save your changes.
We recommend you leave Remote Launch not checked. If you turn this on, the Server (Pump Server service) will be started whenever a client tries to connect. Note that our Enabler clients (EnbSessionX Control) will automatically try to reconnect regularly.
Windows 7 DCOM Configuration
For Windows 7 systems, Distributed COM must be enabled from the "Default Properties" tab.
Using Windows Networking Workgroup (non-domain)
If the Enabler Server belongs to a workgroup instead of a domain, make sure it does not use simple file sharing.
To do this, open "My Computer" from the start menu. Alternatively you can just open "Windows Explorer".
Click "Tools", go to "Folder Options" and then click "View". Uncheck the "Use simple file sharing (Recommended)" in 'Advanced Settings'.
Note: If you still encounter "access denied" or "permission denied" errors after configuring, try restarting your Windows XP / Windows Vista / or Windows 7 server to allow the new settings to take effect.