Solved

Disabling DCOM in an A.D. domain

Posted on 2014-01-09
3
920 Views
Last Modified: 2014-01-11
During a recent internal security audit, our Qualys scanner flagged a Sev3 vuln on our servers. It is a generic vuln for DCOM being enabled (QID 90042)

It suggested disabling DCOM which seems easy enough to do. My question is whether or not there may be adverse effects in an A.D. domain.

http://technet.microsoft.com/en-us/library/cc771387.aspx
0
Comment
Question by:Schuyler Dorsey
3 Comments
 
LVL 53

Accepted Solution

by:
Will Szymkowski earned 500 total points
ID: 39771484
It is probably not a good idea to "disable" this, depending on the applicaitons you are running in your environment. Some applicaitons require this and disabling it can/will break it. Are you sure that this Qualys was not generating a false positive? Usually when there are security holes with com or dcom there are security patches released to correct the vulnerability.

Take a look at the below link for detail description of dcom and it's exact function. From there you can make the decision if you want to disable this in your environment.

DCOM - http://technet.microsoft.com/en-us/library/cc958799.aspx

Will.
0
 
LVL 24

Expert Comment

by:Coralon
ID: 39772942
There are a large number of applications and services that depend on DCOM.  I can't imagine a scenario where disabling DCOM wouldn't cause a problem?

I'd be looking enabling the firewalls and opening up DCOM as needed as an alternative.

Coralon
0
 
LVL 19

Expert Comment

by:compdigit44
ID: 39774016
With any security scan you have to weight the results in proportion to your organization. For example security requirements for a Hospital would differ from that of a Research College. There is no one shoe fits!!!!
0

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Synchronize a new Active Directory domain with an existing Office 365 tenant
This article outlines the process to identify and resolve account lockout in an Active Directory environment.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.

776 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question