Solved

Disabling DCOM in an A.D. domain

Posted on 2014-01-09
3
907 Views
Last Modified: 2014-01-11
During a recent internal security audit, our Qualys scanner flagged a Sev3 vuln on our servers. It is a generic vuln for DCOM being enabled (QID 90042)

It suggested disabling DCOM which seems easy enough to do. My question is whether or not there may be adverse effects in an A.D. domain.

http://technet.microsoft.com/en-us/library/cc771387.aspx
0
Comment
Question by:Schuyler Dorsey
3 Comments
 
LVL 53

Accepted Solution

by:
Will Szymkowski earned 500 total points
ID: 39771484
It is probably not a good idea to "disable" this, depending on the applicaitons you are running in your environment. Some applicaitons require this and disabling it can/will break it. Are you sure that this Qualys was not generating a false positive? Usually when there are security holes with com or dcom there are security patches released to correct the vulnerability.

Take a look at the below link for detail description of dcom and it's exact function. From there you can make the decision if you want to disable this in your environment.

DCOM - http://technet.microsoft.com/en-us/library/cc958799.aspx

Will.
0
 
LVL 24

Expert Comment

by:Coralon
ID: 39772942
There are a large number of applications and services that depend on DCOM.  I can't imagine a scenario where disabling DCOM wouldn't cause a problem?

I'd be looking enabling the firewalls and opening up DCOM as needed as an alternative.

Coralon
0
 
LVL 19

Expert Comment

by:compdigit44
ID: 39774016
With any security scan you have to weight the results in proportion to your organization. For example security requirements for a Hospital would differ from that of a Research College. There is no one shoe fits!!!!
0

Featured Post

U.S. Department of Agriculture and Acronis Access

With the new era of mobile computing, smartphones and tablets, wireless communications and cloud services, the USDA sought to take advantage of a mobilized workforce and the blurring lines between personal and corporate computing resources.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

In this article, we will see the basic design consideration while designing a Multi-tenant web application in a simple manner. Though, many frameworks are available in the market to develop a multi - tenant application, but do they provide data, cod…
In this article, I am going to show you how to simulate a multi-site Lab environment on a single Hyper-V host. I use this method successfully in my own lab to simulate three fully routed global AD Sites on a Windows 10 Hyper-V host.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…

919 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now