Turning Off Activation Security

Normally, activation uses default security settings. However, you can control activation security by specifying a COAUTHINFO structure, which is a member of the COSERVERINFO structure that is passed to the activation functions. If the client specifies an authentication level of RPC_C_AUTHN_LEVEL_NONE in the COAUTHINFO structure, authentication is not attempted. Otherwise, secure activation is attempted, and if authentication fails, activation fails.

If the client does not specify an explicit COAUTHINFO structure and instead sets the pointer to NULL, COM will attempt to authenticate the client. If it cannot authenticate the client, COM checks the launch permission security descriptor to see if there is a NULL DACL or an ACL that allows access to Everyone. If this check succeeds, the server is launched. So, even if the client does not specify a COAUTHINFO structure, unsecure activation may take place when the server allows it.

Why would a client want to turn activation security off explicitly even though unsecure activation will eventually take place if the server allows it? Explicitly turning activation security off increases performance when the client does not want or need security checks.

Both of the following things must be done to explicitly turn off activation security:

• The client must specify an authentication level of RPC_C_AUTHN_LEVEL_NONE in the COAUTHINFO structure that is a member of the COSERVERINFO structure supplied to the activation function.
• The server must specify Everyone for Default Launch Permissions. The recommended way to perform this task is to use Dcomcnfg.exe as follows:
  1. Run Dcomcnfg.exe.
  2. On the Applications page, select the application that represents the server. Click the Properties button (or double-click the selected application).
  3. On the Security property page, select the Use Custom Launch Permissions button.
  4. Click the Edit button in the Launch Permissions area.
  5. In the Registry Value Permissions dialog box, choose the Add button.
  6. Select the entry for Everyone in the list box.
  7. In the Type of Access list box, choose Allow Launch.
  8. Click the OK button.