Skip to main content

Distributed OPC servers/DCOM

warning

Microsoft plans to implement stricter security settings for the DCOM interface starting in spring 2023, meaning that DCOM will only be usable if the highest security standards are met. For more information, see: https://www.opc-router.de/dcom-hardening/

Introduction and prerequisites for a functioning DCOM configuration.

If inray software is to access OPC servers that are not installed locally (on the "inray computer"), a correct DCOM configuration is required on the computer with the OPC server ("OPC computer"). The prerequisites for this are:

  • a Windows user account configured in the shared domain, under which the inray service runs (NT authentication). If a domain user is not available, a local user must be set up on both computers (under which the inray service runs) with exactly the same username and exactly the same password.
  • The firewalls on both computers must allow DCOM communication. DCOM dynamically negotiates the actual communication port: The client first contacts the RPC endpoint mapper on the OPC computer via port 135 and learns there which port the connection will use. Therefore, on the OPC computer, open port 135 and restrict the dynamic port range in the Windows Registry so that only this range needs to be opened. Port 135 and the dynamic port range belong to Windows, not to the OPC Router; the OPC Router’s own ports are listed under Network Ports. The flow is described in the firewall note for the OPC Classic connection.