DCOM user accounts

If the OPC server vendor has prescribed DCOM settings, do not change them unless it is not possible to communicate with the server using those settings. DCOM settings do not retain a history of the changes that were made. To ensure that settings can be reverted back their original settings, you should record the current settings before making any changes. Adjust the client settings to accommodate the server, rather than the other way around.

Access to DCOM servers is controlled by ACLs that specify user accounts and their associated permissions. When the client calls the server, the user account associated with the client process is authenticated, then the ACL is evaluated to determine if that account has permission to use the server.

For interactive clients such as PI OPC Client or PI Interface for OPC DA to run interactively, the effective user is the account that was used to log on to the computer. An interactive process can be run under a different account by using the RunAs command.

For client programs running as Windows services, the user is the account specified in the Logon tab in the Services control panel.

For the OPC server, the user is the account specified in the Identity tab in the DCOM configuration for the server. Windows provides several options for the identity used by a DCOM server:

• Interactive user

  The account that is logged on to the console of the computer where the server is running. This setting is problematic for OPC communications: if no one is logged on to the console or the user logged on does not have DCOM permissions, the client cannot connect to the OPC server.

• Launching user

  The server process runs under the same account as the calling client. Do not use this setting if multiple clients running under different accounts need to access the same OPC server, because a new instance of the OPC server is launched for each user. Note that the user ID of the calling client might not have permission to connect to the server, because many servers implement their own user authentication aside from DCOM permissions.

• This user

  Recommended, unless the OPC server vendor specifies a different setting. Include the specified user in the default DCOM ACLs on the interface node. If the OPC server runs as a Windows service, use the same account as the logon account for the service.

• System account (services only)

  Use only if the interface runs on the same computer as the OPC server.