> I've written a few COM OOP servers that run as services and need
> access to various system resources. Therefore they are configured in
> "Services", to run as the "System Account" - they run and they work
> fine. However, the actual logged on user is a different user and has
> and needs considerably restricted rights. We've found that when the
> logged in user runs a client, it doesn't create the object in the
> already running server, but kicks off another instance of the EXE,
> which for us is disastrous! It kinda makes sense what COM is doing
> since I presume it's not allowing a restricted client to connect/use a
> server that has complete access rights, since it kinda breaks the
> security model.

> So my question is - is there a way of getting around this security
> 'wall'? Can I somehow register my clients as being 'trusted'? I'm
> writing all the code, so any necessary changes can be made.

> This is all in ATL, running on NT4 SP6

> Cheers

> Simon

> >Have you configured your server as service with regard to COM?
> >This is done by running it with the /Service command-line param.
> >This assuming you use ATL of course, but judging from the group
> >you are posting to...

> Ah! Come to think of it, the system is slightly different to that what
> I'd described, and maybe you've hit the nail on the head. There's
> actually only one service, which kicks off a handful of other COM
> server processes, all of which presumably inherit the system account
> rights. Are you saying that if all the OOP servers were actually
> services, my restricted clients would connect to the service, rather
> than kick of another instance of the EXE as they're doing now? I could
> try this of course, but converting an exe to a service will be
> tiresome if it's not going to make any difference?

> Thanks

> Simon