DCOM question and problematic response (Is the tech untrained or evading an answer?).

Question

DCOM question and problematic response (Is the tech untrained or evading an answer?).

m g 5

Surely the people responding to question are not trained techs who have already learned Microsoft - because there are no answers, only responses about dealing with the problems DCOM is reporting that can not happen on the computer according to the person with the problem. (So the grasp of the English language of the tech answering may also in question.)

At issue is the question of disabling DCOM. What is it doing that is considered so vital (to Microsoft) that unnecessarily and relentlessly creates error logs not relate to the nonnetworked computer system of the person reporting the problem?

Yes, I have a similar issue, except mine also has included relentless disconnects during voip phone calls, online orders, online banking, and unannounced downloading of disabled unwanted updates that should not be happening because of using an end of life version of windows. I do NOT have the voip phone networked, however that has not stopoed the repeated enabling of UPnP which I have to repeatedly disable. Currently, knock on wood, these problems are not happening.

However, the relentless overuse of my equipment with the constant logging of errors, and lagging it creates, is absolutely unnecessary for my purposes. And to be honest, I do not consider MY computer and MY use of it to be available for Microsoft to manage for microsoft purposes, which is more use and abuse I do not need than it is management I also do not need or want from Microsoft of my computer use - especially given how tech answers avoid answering exactly what the service is "managing".

DCOM supposedly has something to do with cross-platform use (regarding apps online which I do not use). And it apparently also has something to do with hardware compatibility. However my AMD hardware is compatible with Microsoft. And I do not have "microsoft tech" installed (e.g. Cortina has been disabled from the start, no installation of the relentless snapshot feature, no A.I. installed, and no mic or camera), and every app possible to disable has been disabled.

A tolerantly humorous explanation at the root of the problem, from someone else on a different platform, seems to make very clear what the problem actually is:
"How about saying hey this is a Windows service /process, Imma gonna do this to that for precisely this reason--and I'll be outta here; is that okay with you?"

The request I read about DCOM constantly running and its double the over-use of the equipment because of creating error messages for everything it is doing, especially all the errors for what is not happening on the computer, that something online is apparently trying to access and make happen.

Threats in the description of the service that the "computer may not boot" if DCOM is disabled, and the absence of any clearly stated information about the purpose(s) of the service, indicate that Microsoft really, really, really, wants the service to run, even though numerous people state that the errors it reports on a nonstop basis are not associated with how they have their computer configured, how they use it, and peripheral equipment they do not have or use. I have that problem too.

Why is there so much evasion in the so called answers that more or less respond with a deflecting response that conveys the interpreted message: "ignore the activity, and disregard the fact that it is wearing out your equipment with its over use of erroneous error reporting"?

0 comments

1 answer

Your answer

Answer 1

DCOM is a core Windows technology, not an optional “extra” service, which is why guidance often discourages disabling it and focuses instead on mitigating issues around it.

Key points from the provided material:

What DCOM does

DCOM (Distributed Component Object Model) is the network-capable extension of COM.
It enables COM components on one computer to communicate with components on the same or other computers over the network.
It uses the RPCSS service and RPC networking (ports such as 135, 139, 445, 593, and, if CIS/RPC over HTTP are enabled, ports 80 and 443).
Many Windows components and applications rely on COM/DCOM for activation, launch, and remote/local access to COM servers.

Why Microsoft strongly discourages disabling DCOM

Official guidance explicitly lists “Disable DCOM on all affected machines” as a workaround for certain security vulnerabilities, but warns about the impact:
- Disabling DCOM breaks all communication between COM objects on that computer and COM objects on other computers.
- If DCOM is disabled on a remote computer, it cannot be remotely accessed to re-enable it; physical access is required.
- For some vulnerabilities, disabling DCOM is described as a mitigation with clear warnings that it can significantly affect functionality.
Another article describes that DCOM computer‑wide restrictions and controls were added to:
- Allow administrators to enforce stronger security (local vs remote launch/activation/access permissions).
- Give administrators the capability to disable incoming DCOM activation, launch, and calls without fully disabling COM/DCOM.
In other words, Microsoft’s design assumes DCOM is present and running. The platform then adds finer-grained security and restriction options instead of recommending that users turn DCOM off entirely.

Why there are many DCOM-related errors and logs

The security bulletins and DCOM security enhancements documentation show that:
- DCOM and RPCSS expose network interfaces that can be called remotely.
- Misconfigurations, unreachable hosts, blocked ports, or disabled services can generate DCOM/RPC errors (for example, event 10009 and similar) that are often network-communication related.
- These errors can occur even when the user believes the system is “non‑networked” if Windows components or services still attempt remote activation or network discovery.
The logging is by design: it records failed activations, access attempts, or communication problems so administrators can diagnose security and connectivity issues.

Why answers often say “don’t disable DCOM” instead of “turn it off”

The official guidance emphasizes:
- DCOM is a foundational communication mechanism for Windows components.
- Disabling it can break remote management, distributed applications, and any COM server that expects remote activation or access.
- Once disabled on a remote system, it cannot be re-enabled remotely.
Because of this, support guidance tends to:
- Recommend firewalling, IPSec filters, or disabling specific paths like COM Internet Services (CIS) and RPC over HTTP.
- Recommend using DCOM security enhancements (machine‑wide launch/access restrictions, Distributed COM Users group, etc.) to limit exposure.
- Treat full DCOM disablement as a last-resort workaround for specific security issues, not as a general performance or “noise reduction” step.

What is actually being “managed” by DCOM

DCOM itself is not a “management” service in the sense of Microsoft remotely controlling a user’s PC.
It is the infrastructure that:
- Activates COM servers (locally or remotely) via RPCSS.
- Enforces launch/access permissions for COM applications.
- Provides the wire protocol for COM components to communicate across processes and machines.
The “management” aspect is that many Windows services and applications use COM/DCOM under the hood. When they attempt remote or distributed operations and fail, DCOM logs the failures.

Why Microsoft emphasizes security controls instead of silence

The security documentation highlights that:
- Many COM servers historically allowed unauthenticated remote access.
- Administrators had difficulty understanding exposure and enforcing stronger security.
- Newer versions introduced machine‑wide restrictions and separate local/remote launch/access rights to mitigate these threats.
This focus on security and control explains why the official guidance is detailed about permissions, groups, and restrictions, and less about “turning DCOM off to stop logs.”

In summary, DCOM is a core part of Windows’ COM/RPC infrastructure. Microsoft’s documentation treats it as essential and provides security and restriction mechanisms rather than recommending that it be disabled. The warnings about system impact and loss of remote access when disabling DCOM are explicit, which is why many answers focus on mitigation (firewalls, CIS/RPC over HTTP disablement, DCOM security restrictions) instead of endorsing full shutdown of DCOM just to eliminate error logs.

References: