{"id":376,"date":"2019-05-09T10:19:40","date_gmt":"2019-05-09T10:19:40","guid":{"rendered":"http:\/\/opcconnect.integrationobjects.com\/?p=376"},"modified":"2026-04-03T16:11:50","modified_gmt":"2026-04-03T16:11:50","slug":"dcom-settings-for-opc-communications","status":"publish","type":"post","link":"https:\/\/integrationobjects.com\/blog\/dcom-settings-for-opc-communications\/","title":{"rendered":"DCOM Settings for OPC Communications: Complete Configuration Guide"},"content":{"rendered":"\r\n

Configuring DCOM settings<\/a> for OPC is one of the most common and most frustrating tasks in industrial automation. Done correctly, it enables reliable remote communication between OPC Classic clients and servers. Done incorrectly, it produces cryptic “access denied” errors, RPC failures, and firewall headaches that can take days to diagnose.<\/p>\r\n

This guide explains what DCOM is, why OPC Classic depends on it, how to configure DCOM settings step by step for OPC communications, how to fix the most common errors, and critically how to evaluate whether eliminating DCOM entirely is the better long-term choice for your environment.<\/p>\r\n

What is DCOM?<\/h2>\r\n\r\n\r\n\r\n

DCOM (Distributed Component Object Model) is a Microsoft protocol that extends COM (Component Object Model) across a network. It enables applications running on different Windows machines to communicate with each other using Remote Procedure Calls (RPC). DCOM handles authentication, marshalling of data, and the management of remote object lifetimes all transparently to the application.<\/p>\r\n

In practical terms, DCOM is the layer that allows an OPC client on one machine to discover and call an OPC server object running on a completely different machine, as if it were local.<\/p>\r\n

Why does OPC Classic require DCOM?<\/h2>\r\n

OPC Classic including OPC DA (Data Access), OPC HDA (Historical Data Access), and OPC AE (Alarms & Events) was built on Microsoft’s COM\/DCOM technology.<\/a> When an OPC client and server run on the same machine, they communicate via COM over shared memory. The moment communication crosses a network boundary to a remote machine, DCOM takes over.<\/p>\r\n

This architecture was a practical choice in the 1990s when OPC was designed: DCOM was the standard Microsoft mechanism for distributed Windows applications. It provided automatic service discovery, security integration with Windows user accounts, and transparent remote object access. However, DCOM was designed for closed, trusted networks not the increasingly interconnected IT\/OT environments of today.<\/p>\r\n

The result is that any remote OPC Classic connection depends entirely on DCOM being correctly configured<\/a> on both machines. A single misconfigured permission, a blocked firewall port, or an authentication mismatch is enough to prevent the connection entirely.<\/p>\r\n

What DCOM settings need to be configured for OPC?<\/h2>\r\n

DCOM configuration for OPC involves settings at two levels: machine-wide settings that apply to all DCOM communication on the Windows host, and application-specific settings that apply to the OPC server component itself. Both levels are managed through dcomcnfg<\/code> \u2014 the Windows DCOM configuration tool, accessible via Start \u2192 Run \u2192 dcomcnfg<\/code>.<\/p>\r\n

Machine-wide DCOM settings (Component Services)<\/h3>\r\n

These settings apply to all DCOM traffic on the machine and must be configured on both the OPC server and OPC client machines:<\/p>\r\n

Authentication level:<\/strong> Set to “Connect” as the minimum for basic OPC communications. Note: as of the Microsoft KB5004442 hardening update<\/a> (enforced since March 2023), remote DCOM connections now require “Packet Integrity” as the minimum level. Any OPC client that does not support this level will be rejected by a patched server.<\/p>\r\n

Enable DCOM:<\/strong> In dcomcnfg<\/code>, navigate to Component Services \u2192 Computers \u2192 My Computer \u2192 Properties \u2192 Default Properties tab. Ensure “Enable Distributed COM on this computer” is checked.<\/p>\r\n

Default authentication level:<\/strong> Set to “Connect” under Default Properties.<\/p>\r\n

Default impersonation level:<\/strong> Set to “Identify” under Default Properties.<\/p>\r\n

Access permissions:<\/strong> Under the COM Security tab, ensure that the user account running the OPC client application has both local and remote access permissions. For workgroup environments (non-domain), you must create matching user accounts with identical usernames and passwords on both machines.<\/p>\r\n

Launch and activation permissions:<\/strong> The user account running the OPC client must have remote launch and remote activation permissions, either granted directly or through group membership.<\/p>\r\n

Application-specific DCOM settings (for the OPC server)<\/h3>\r\n

Each OPC server registers itself as a DCOM application. To configure its specific settings:<\/p>\r\n

    \r\n
  1. Open dcomcnfg<\/code> and navigate to Component Services \u2192 Computers \u2192 My Computer \u2192 DCOM Config<\/li>\r\n
  2. Locate your OPC server in the list (it will appear by its registered application name)<\/li>\r\n
  3. Right-click \u2192 Properties \u2192 Security tab<\/li>\r\n
  4. Configure Launch and Activation Permissions: grant the remote OPC client user account “Remote Launch” and “Remote Activation” rights<\/li>\r\n
  5. Configure Access Permissions: grant the remote OPC client user account “Remote Access” rights<\/li>\r\n
  6. Under the Identity tab: set the account the OPC server runs as \u2014 typically “The interactive user” for servers that need to interact with hardware, or a dedicated service account for headless deployments<\/li>\r\n<\/ol>\r\n

    Firewall port configuration for DCOM<\/h3>\r\n

    DCOM uses TCP port 135 (the RPC Endpoint Mapper) as its initial contact point, and then negotiates a dynamic high-numbered port for the actual data transfer. This dynamic port allocation is the primary reason DCOM is difficult to use across firewalls.<\/p>\r\n

    To enable DCOM through a firewall for OPC:<\/p>\r\n