2012 server Dcom permissions

[asterof]

Three machines running 2012 R2 SP1 on Dell Blade Servers
Three BoxPC thin clients running Thin Manager software
Three 2012 servers are DOMAIN, Terninal Server, iFix 5.8 SCADA

I am told the only way that the thin clients can access DCOM
on the SCADA machine is by making the thin client login accounts
Domain Administrator Accounts. We have tried for days to use
domain user accounts and it would not work.
Does anyone know if it can be done accessing DCOM on a 2012
SCADA machine using thin clients logging into thinmanager on the Terminal Server running a view node of iFix accessing the SCADA machine

Thanks
BTW I had GE online and they told me this (see below)


-----Original Message-----
From: GE Case [mailto:[email protected]]
Sent: Tuesday, October 18, 2016 2:28 PM
To: xxxxxxxxxxxxxxxxxxxx
Subject: Update - Case xxxxxx - Issue with a iFix 5.8 Terminal Server Communicating To the Scada

Hello xxxxxxxxxxx,

Glad to hear you got the thin clients working….

With respect to the issue of DCOM, please understand the OPC requirements are dictated by Microsoft. You may be able to use a user domain account, but the permissions were configured for a Domain Admin account.

Lastly, given this is now communicating, please let me know if you have any other questions on this case and please let me know how I should proceed. Thank you.

Regards,
xxxxxxx xxxxxx

Software Support
GE
http://www.ge-ip.com/support

 

[Fred_Loveless]

Yes and no. Starting with introduction of UAC all users run as standard users with the ability to elevate . The User has to have Administrative privileges so that it can browse for registered OPC DA servers. Usually it is recommended to create a Group that has all the privileges that are needed to make the DCOM connection and then add Users to that group. They will inherit the permissions of the group for DCOM only.

Also you should set DCOM at the application level if you have an open network. It it is closed, not external access, then you can open it up wide.