DCOM

What is DCOM?

DCOM (Distributed Component Object Model) is a Microsoft technology that lets software components on different Windows computers call each other across a network as if they were running locally, built on the Component Object Model (COM) and Remote Procedure Calls (RPC). Within OT and Industrial Automation, DCOM became the transport layer for OPC DA and the rest of OPC Classic from 1996 onwards. For years it carried process data between SCADA, HMI, historians and PLC drivers. Because of difficult firewall management, security weaknesses and limited scalability, modern OT convergence architectures are replacing DCOM with OPC UA, MQTT and web-based APIs.

🧠 How do COM and DCOM relate to each other?

COM is the Windows object model that lets a program call a software component through a fixed interface, independent of programming language. A COM object runs in the same process or in another process on the same computer. DCOM, originally called Network OLE, extends this to other computers. Microsoft shipped DCOM with Windows NT 4.0 in 1996, and a beta for Windows 95 followed in September that year.

For the developer little changes: the client requests an object and calls its methods, while DCOM packages the call under the hood (marshaling), sends it across the network via RPC and returns the result. Microsoft RPC is derived from the OSF DCE RPC standard with Microsoft-specific extensions.

🔧 How does a DCOM connection work?

A DCOM connection between an OPC client and an OPC server on another computer goes through these steps:

1. Activation request - the client asks the server’s RPCSS service, via TCP port 135, to start or bind to the object (identified by a CLSID).
2. Permission check - the server checks the Launch and Activation Permissions and Access Permissions from dcomcnfg against the client’s account.
3. Port assignment - the Endpoint Mapper returns a dynamic port on which the object listens.
4. Object reference - the client receives a marshaled reference that contains the server’s real IP address.
5. Calls and callbacks - the client calls methods; with OPC DA the server sends value changes back through a callback. For that, the client itself becomes a DCOM server, so traffic also flows from server to client.

Those last two steps explain most problems in practice. Because the IP address is embedded in the reference, DCOM does not work through network address translation (NAT). Because callbacks travel the other way, the firewall must be open in both directions.

🧩 Why did DCOM become the standard in OT?

In the 1990s Windows was the dominant platform for SCADA, HMI and historian software. DCOM came built into the operating system and gave vendors a ready-made way to connect components across the network. The OPC Foundation therefore chose it in 1996 as the basis for OPC DA.

⚡ Which ports does DCOM use?

DCOM always starts on TCP port 135 and then switches to a dynamic port. Since Windows Vista and Windows Server 2008 the default range is 49152 to 65535; older versions such as Windows XP and Server 2003 used 1025 to 5000.

You can restrict the range with the registry key HKLM\Software\Microsoft\Rpc\Internet, setting Ports (for example 5000-5100), PortsInternetAvailable and UseInternetPorts to Y, followed by a restart. Microsoft advises using ports above 5000 and at least 100 ports, because system services also rely on these RPC ports. A range that is too narrow leads to port exhaustion.

🔐 How is the DCOM security model structured?

DCOM relies on Windows security. Per application (AppID) or system-wide, you set in dcomcnfg who may launch and use an object. Two further levels determine how strongly a connection is protected:

• Authentication level - from None (1) through Connect, Call and Packet up to Packet Integrity (5) and Packet Privacy (6). Packet Privacy encrypts the RPC payload, but in OPC installations the level was often set low or even to None.
• Impersonation level - Anonymous, Identify, Impersonate or Delegate: how much the server may do on behalf of the client’s identity.

For a long time, vendor manuals advised setting the authentication level to None and granting rights to Everyone or ANONYMOUS LOGON, especially in workgroups without a domain. That made OPC work, but it also let anyone on the network operate the OPC server.

⚠️ Which cybersecurity risks does DCOM introduce?

DCOM was designed for isolated, trusted networks, long before cybersecurity was a topic in OT. As office and process networks were connected, it became a well-known attack path:

• Vulnerabilities in RPCSS - MS03-026 (July 2003) was a buffer overflow in the DCOM activation interface that let an attacker run code with LocalSystem privileges via port 135 on Windows NT 4.0 up to Server 2003. The Blaster worm exploited it on a large scale from August 2003.
• Lateral movement - MITRE ATT&CK describes DCOM as technique T1021.003: with valid administrator credentials, attackers remotely start objects such as MMC20.Application or Excel to execute code.
• Weak configuration - anonymous access, shared local accounts with the same password on every station and a disabled Windows Firewall.
• Large attack surface - a widely opened dynamic port range makes network segmentation effectively worthless.

🛡️ What does the DCOM hardening KB5004442 mean for OT?

With KB5004442 (CVE-2021-26414), Microsoft requires DCOM activation requests to use at least the Packet Integrity level. The change was rolled out in three phases:

The temporary registry value was RequireIntegrityActivationAuthenticationLevel under HKLM\SOFTWARE\Microsoft\Ole\AppCompat. Windows clients with the cumulative updates from January 2023 onwards automatically raise non-anonymous activation requests to Packet Integrity. OPC clients on unpatched or unsupported Windows versions, such as Windows XP or a Windows 7 machine that no longer receives updates, and third-party DCOM implementations that do not do this, are rejected by an updated server. When troubleshooting, check the System log: event ID 10036 on the server and 10037 or 10038 on the client.

🏭 How do you secure an existing DCOM environment?

Many legacy systems cannot be replaced in the short term because of vendor lock-in, old PLC drivers, validation requirements and production continuity. A practical hardening approach:

1. Inventory every DCOM flow: which OPC clients talk to which servers, across which subnets and Purdue levels.
2. Keep DCOM inside one zone and never let it cross the DMZ or the office network. Define connections between zones in a segmentation architecture based on IEC 62443.
3. Restrict the RPC port range and on an industrial firewall allow only port 135 and that range, between fixed IP addresses and in both directions. Some firewalls can filter RPC by interface UUID: they read the Endpoint Mapper response and open the port for that one interface only.
4. Use domain accounts or dedicated service accounts with least privilege, remove Everyone and ANONYMOUS LOGON from dcomcnfg and set the authentication level to at least Packet Integrity.
5. Patch the Windows stations through patch management and test the OPC connections after every update.
6. Monitor DCOM traffic with logging and security monitoring: an unexpected DCOM call to port 135 followed by a new process is a classic sign of lateral movement.
7. Replace network DCOM where possible with a local OPC tunnel or an OPC UA wrapper, so that DCOM only runs on a single computer.

NIST SP 800-82 and IEC 62443 provide the framework for this; for organisations working with NIST CSF or other compliance requirements, such a legacy exception also belongs in the risk register.

🔄 What is the difference between DCOM and OPC UA?

OPC UA appeared in 2006 as the successor to OPC Classic and solves the biggest DCOM problems: it is platform-independent, runs over a single fixed TCP port (4840 by default) and has its own certificate-based security model.

Common migration strategies are OPC UA wrappers around existing OPC DA servers, protocol gateways on an edge computer, parallel infrastructure for a phased transition and forwarding data to MQTT and a Unified Namespace. Tunnelling software that keeps DCOM local and uses its own TCP connection between computers is an intermediate step: more firewall-friendly and more stable over a WAN, but no substitute for a proper architecture based on ISA-95.

🌍 Where do you still find DCOM?

In all these sectors, OPC DA servers from the 2000s are still running. DCOM itself is still part of current Windows versions, so it will only disappear once the last OPC Classic application has been phased out.

❓ Frequently asked questions

What does DCOM stand for?

DCOM stands for Distributed Component Object Model. It is the network extension of Microsoft’s Component Object Model (COM), which lets software components on different Windows computers call each other via RPC.

Which ports do I need to open for DCOM?

DCOM uses TCP port 135 for the RPC Endpoint Mapper and then a dynamic port, by default between 49152 and 65535 since Windows Vista. Restrict that range in the registry and allow it only between fixed IP addresses, in both directions because of OPC callbacks.

Why did my OPC DA connection stop working after a Windows update?

Since the DCOM hardening KB5004442, which became permanent on 14 March 2023, an updated server rejects DCOM activation below the Packet Integrity level. OPC clients on unpatched or outdated Windows versions do not raise their level automatically, so they need to be updated, replaced or connected through a local tunnel.

Is DCOM encrypted?

DCOM can encrypt RPC traffic with the Packet Privacy authentication level, but this was rarely enabled in OPC installations. DCOM has no TLS or certificates, so for confidential connections across network boundaries OPC UA with SignAndEncrypt is the better choice.

Can DCOM pass through a firewall with NAT?

No, DCOM does not work through network address translation, because the server’s real IP address is embedded in the object reference. For connections through NAT or across a WAN, an OPC tunnel or a migration to OPC UA are the usual solutions.

Should I disable DCOM completely?

Disabling DCOM through dcomcnfg reduces the attack surface, but it breaks every networked OPC Classic connection and some management tools. Only disable network DCOM on systems that demonstrably do not need it, and harden the rest.

📌 In summary

DCOM is the Microsoft technology that has made networked OPC Classic possible since 1996, but its dynamic ports, NAT problems and weak default security make it a well-known risk in OT networks. Keep DCOM within one zone, restrict ports and permissions, account for KB5004442 and migrate step by step to OPC UA or MQTT.