🚀 go-pugleaf

Hi all, got a really annoying problem that we are struggling to solve. 
Sorry if this is not the correct group be since it involves NT Services and 
ACL rights I thought I might be able to push it.

I posted a few weeks ago about creating a DCOM server interface as an NT 
Service so that it could effectively run all the time, regardless of if any 
users were logged on to Windows.  Remy directed me to a MSDN article 
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dncomg/html/localserv.asp 
which described the necessary registry changes that needed to be made in 
order to get the service to work correctly.

Having followed this, we have created out DCOM / NTService which works 
perfectly fine under Windows 2000.When we tested it on Windows XP service 
pack two we had to make some amendments to the permissions in order to get 
it to function properly (I notice a post on the cppbuilder.activex (R.E. 
DCOM events WindowsXP SP2) which had a link to 
http://www.ct2k.com/cns2006/CT2K-XPDCOM.ppt).  Under XP SP2 the NT Service 
ran ok but we couldn't connect to it with our client application.  We 
basically resolved it by adding the current user account into all the 
permissions for DCOM on that machine AND for the particular DCOM server.

Now we are trying to get it to work under Windows 2003 Enterprise with no 
sucess.  We've tried all the combinations that we can think of, of adding in 
users to the permissions with no success.  It's is defiantly a security 
permissions problem.  The Service starts ok and runs fine but the client 
cannot connect to it.  One of our Russian Developers found this article 
http://www.rsdn.ru/article/com/comsec.xml#ERBA which (although it is in 
Russian) we've followed but still with not success.  The code has been 
tested with and without the following

  HRESULT hr = CoInitializeSecurity(sd, -1, NULL, NULL, 
RPC_C_AUTHN_LEVEL_PKT, RPC_C_IMP_LEVEL_IMPERSONATE, NULL, EOAC_NONE, NULL);

to no avail - hr never equals S_OK.  The article seems to suggest that if a 
users is a member of a group that does not have permissions to run DCOM, 
then even if the user is directly added to the permissions for that object, 
they still will not be able to execute the DCOM object.  It also seems to 
suggest that if a user is a member of two groups, A & B, if A is allowed to 
run DCOM and B is not, then overall the user will NOT be able to run the 
DCOM object <- is this correct?

I anyone shed some light on this, it's a real problem for use

Many thanks in advance,

Mike Collins