This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(313.6, 98%, 40%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJC%3C/text%3E%3C/svg%3E)
During Step 2 of the Product Deployment Wizard I keep getting this error regarding launch conditions on DCOM layer.
Error 27693, Error 0x80004005 setting launch conditions on DCOM layer during action SetDCOMSecurityEx. --Event Viewer
Error returned while installing Server.msi. (Feature_Server, Feature HealthAgent) code 1603.
I have tried to change the permission in DCOM and still can't get passed this step.
A Microsoft communications service that provides communications capabilities across presence, instant messaging, audio/video calling, and an online meeting experience that includes audio, video, and web conferencing.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(112.00000000000001, 24%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJM%3C/text%3E%3C/svg%3E)
Hi @Joshua Crisp ,
According to your error message, we firstly recommend you check if you have installed all the pre-req software in order to support the Skype for Business Front-end Server. The following command are just for your reference:
Add-WindowsFeature NET-Framework-Core, RSAT-ADDS, Windows-Identity-Foundation, Web-Static-Content, Web-Default-Doc, Web-Http-Errors, Web-Asp-Net, Web-Net-Ext, Web-ISAPI-Ext, Web-ISAPI-Filter, Web-Http-Logging, Web-Log-Libraries, Web-Request-Monitor, Web-Http-Tracing, Web-Basic-Auth, Web-Windows-Auth, Web-Client-Auth, Web-Filtering, Web-Stat-Compression, Web-Dyn-Compression, NET-WCF-HTTP-Activation45, Web-Asp-Net45, Web-Mgmt-Tools, Web-Scripting-Tools, Server-Media-Foundation
In addition, please make sure you have added the following groups in RTC Store Access Interface Class Properties: RTC Local Administrators, RTC Local User Administrators and RTC Server Local Group. For more details, you can refer to:
https://www.realtimeuc.com/2016/03/dcom-error-sfb-cscp/
If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
The RTC Store Access interface Class has not been created yet. It does not seem to get that far.
You can try to refer this blog to check if you have met the requirements before deploying Skype for Business Server.
Is there any update on this issue?
I ended up fixing this in group policy to allow the group EVERYONE to make remote SAM calls. Once I finished the install I was able to use the default policy in Group Policy again. For some reason it would not allow the completion of step 2 until I did that.
I am glad to hear you have resolved this issue.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(192, 54%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMM%3C/text%3E%3C/svg%3E)
Just to be clear, this policy gets applied to your Domain Controllers in the domain that the skype servers are a member of and possibly trusted and child domains. Seems some administrators read that setting from other installs (ie. exchange, or sharepoint) as ensure administrators have that right, they set it in policy, which removed the default settings, in most cases covered Everyone or Authenticated Users. Setting an undefined group policy, (Undefined at any level) overwrites any defaults. That's what broke our install. That setting relates directly to the server.msi dcom error we had.
** **0x80004005 setting launch conditions on DCOM layer during action setdcomsecurityex ** Skype For Businiess 2019 when installing front end servers.
If you're in a STIG'd environment, using the EVERYONE security principal is bad, but Authenticated Users works just fine, which more closely covers the security requirements to not use the everyone security principal in any setting. If the SKYPE developers could actually publish the minimum requirements for this setting, it would be secured even more: SKYPE servers? Skype Service Accounts? Actual Users in the domain, and trusted domains?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(22.400000000000002, 86%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJ%3C/text%3E%3C/svg%3E)
@Mac MacAnanny I just saw this because I am standing up for another air-gaped Skype install. Yes, we are STIG'd. I could not get authenticated users to work. I just put in Everyone, finish the install then change it back. installing software in an air gaped STIG'd network is becoming more and more of a pain in the butt. Thanks for the information though. I couldn't believe I searched up the same error and landed on this post I forgot I put in 2021. Lol.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(256, 94%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EB%3C/text%3E%3C/svg%3E)
My team encountered similar error but the given solution doesn’t work for us:
Error ID 27693 installing server.msi (fe health agent) error in setting DCOM config
In a highly secured air gap network, what else should we look for? Beside port 135, what are the ports required for setting DCOM config?