Full Disclosure mailing list archives
More for the grist mill (or bad news for admins)
From: "Schmehl, Paul L" <pauls () utdallas edu>
Date: Fri, 1 Aug 2003 11:23:14 -0500
I've been doing some research on DCOM to try to figure out whether it's even practical to disable it. Turns out that SMS uses DCOM, so it that's how you're distributing patches, you *probably* don't want to disable DCOM. It appears that Group Policies also use DCOM as does the Management Snap-ins and possibly SUS (it's difficult to confirm that on MS's site, but I'd be surprised if they don't), so disabling DCOM means you might as well stop using Windows entirely. (Not that that would be a *bad* thing, but for many of us it's simply not an option.) One more thing. If you disable DCOM, it can only be reenabled on the box. You've lost Remote Admin access, so you're going to have to physically touch the box to reenable. (See the Q article: <http://support.microsoft.com/default.aspx?scid=kb;en-us;823980> See this page for SMS using DCOM: <http://support.microsoft.com/default.aspx?scid=kb;en-us;215015> SUS uses "Windows Update technology" to determine if a patch is needed. So much for patching accurately with SUS. (As I pointed out in a post yesterday, checking the registry for a Q article install proves nothing. The files could have been overwritten later with unpatched versions.) See this article: <http://www.microsoft.com/windows2000/windowsupdate/sus/suscomponents.as p> A bunch of tech articles may be found here: <http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dndcom /html/msdn_dcomarch.asp> Paul Schmehl (pauls () utdallas edu) Adjunct Information Security Officer The University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu/~pauls/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- More for the grist mill (or bad news for admins) Schmehl, Paul L (Aug 01)