In the DCOM protocol, remote reference counting is conducted per interface (per IPID).
The actual increment and decrement calls are carried out using (respectively) the RemAddRef and RemRelease methods in a COM interface known as IremUnknown found on the OXID object associated with each OXID, the IPID of which is returned from the function IOXIDResolver::ResolveOxid (section 5.2.1) or IRemoteActivation::RemoteActivation (section 6.2.1). In contrast to their analogues in IUnknown, RemAddRef and RemRelease can in one call increment or decrement the reference count of many different IPIDs by an arbitrary amount; this allows for greater network efficiency. In the interests of performance, client COM implementations typically do not immediately translate each local AddRef and Release into a remote RemAddRef and RemRelease. Rather, the actual remote release of all interfaces on an object is typically deferred until all local references to all interfaces on that object have been released. Further, one actual remote reference count may be used to service many local reference counts; that is, the client infrastructure may multiplex zero or more local references to an interface into zero or one remote references on the actual IPID.
To prevent a malicious application from calling RemRelease incorrectly, an application may request secure references. In that case the application must call RemAddRef (and RemRelease later on) securely and must request private references. Private references are stored by client identity so one client cannot release another client’s references. DCOM requires that each client make a call to get his own secure references, rather then receiving a secure reference from someone who already has one. This reduces the efficiency of interface marshalling because the client must make a callback.