More for the grist mill (or bad news for admins)

["Schmehl, Paul L" <pauls () utdallas edu>]

I've been doing some research on DCOM to try to figure out whether it's
even practical to disable it.  Turns out that SMS uses DCOM, so it
that's how you're distributing patches, you *probably* don't want to
disable DCOM.  It appears that Group Policies also use DCOM as does the
Management Snap-ins and possibly SUS (it's difficult to confirm that on
MS's site, but I'd be surprised if they don't), so disabling DCOM means
you might as well stop using Windows entirely.  (Not that that would be
a *bad* thing, but for many of us it's simply not an option.)

One more thing.  If you disable DCOM, it can only be reenabled on the
box.  You've lost Remote Admin access, so you're going to have to
physically touch the box to reenable.  (See the Q article:
<http://support.microsoft.com/default.aspx?scid=kb;en-us;823980>

See this page for SMS using DCOM:
<http://support.microsoft.com/default.aspx?scid=kb;en-us;215015>

SUS uses "Windows Update technology" to determine if a patch is needed.
So much for patching accurately with SUS.  (As I pointed out in a post
yesterday, checking the registry for a Q article install proves nothing.
The files could have been overwritten later with unpatched versions.)
See this article:
<http://www.microsoft.com/windows2000/windowsupdate/sus/suscomponents.as
p>

A bunch of tech articles may be found here:
<http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dndcom
/html/msdn_dcomarch.asp>

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/~pauls/ 
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html