Establishing OPC Communication on different Windows versions
The scope of these tutorials is to guide you through setting up the OPC Communication on different Windows versions.
Users will often experience difficulties with OPC Communication due to advanced security settings.
This document describes how to disable these security settings to allow OPC Communication:
DCOM has limitations for connectivity when operating on separate domains/workgroups. These steps may work but, depending on individual networks, additional settings and components may be required.
DCOM Security settings
OPC uses ActiveX COM and DCOM to communicate, so we must open our DCOM permissions to allow this.
Go to Start > Run (or press Windows + R).
Type in dcomcnfg and click OK.
Go to Console Root > Component Services > Computers > My Computer. Right-click on My Computer and select Properties.
Go to the Default Properties tab and ensure that your Window matches the one shown below:
Go to the COM Security tab. Under Access Permissions, click on the Edit Limits button.
Ensure that you have allowed permissions to Anonymous Logon, Everyone, Interactive, Network, and System as shown below. Then click OK.
Under Access Permissions, select the Edit Default button.
Ensure that you have allowed permissions to Anonymous Logon, Everyone, Interactive, Network, and System as shown below. Then click OK.
Under Launch and Activation Permissions, select Edit Limits.
Ensure that you have allowed permissions to Anonymous Logon, Everyone, Interactive, Network, and System as shown below. Then click OK.
Under Launch and Activation Permissions select Edit Default.
Ensure that you have allowed permissions to Anonymous Logon, Everyone, Interactive, Network, and System as shown below. Then click OK.
We have successfully configured the default DCOM settings. Click OK to return to the Component Services window.
Under My Computer, open the folder labeled DCOM Config.
Browse to your OPC Server, right-click on it, and select Properties.
Under the General tab, set the Authentication Level to Connect.
Go to the Security tab. Under Launch and Activation Permissions, select the Customize button. Then click Edit.
Ensure that you have allowed permissions to Everyone, Interactive, Network, and System as shown below. Then click OK.
Under Access Permissions choose the Customize button. Then click Edit.
Ensure that you have allowed permissions to Everyone, Interactive, Network, and System as shown below. Then click OK.
Go to the Identity tab. Ensure that your server is either running as The interactive user OR, if it is running as a service, The system account. Click OK to return to the Component Services window.
In the DCOM Config folder browse to OpcEnum. Right click on it and select Properties.
Under the General tab ensure that the Authentication Level is set to Connect.
Go to the Security tab. Under Launch and Activation Permissions, select the Customize button. Then click Edit.
Ensure that you have allowed permissions to Everyone, Interactive, Network, and System as shown below. Then click OK.
Under Access Permissions select the Customize button. Then click Edit.
Ensure that you have allowed permissions to Everyone, Interactive, Network, and System as shown below. Then click OK.
Go to the Identity tab. The user should be set to The system account, as OpcEnum runs as a service. Click OK. The DCOM settings on this machine are now correct.
The Windows Firewall
If the Windows Firewall is up and running, it will interfere with communication between applications on the system.
There are ways to specify which applications are allowed through the Firewall – if you wish to do so, documents are available from the OPC Foundation which describe the procedure (www.opcfoundation.org).
Otherwise, disable the firewall by walking through the following steps:
Go to Start > Control Panel as shown:
In Control Panel, go to System and Security > Windows Firewall.
In the Windows Firewall window, click on the Turn Windows Firewall on or off.
Select Turn Off Windows Firewall (not recommended) for your network and click OK to confirm.
Data Execution Prevention
Data Execution Prevention (DEP) is a set of hardware and software technologies that perform additional checks on memory to help prevent malicious code from running on a system. In Microsoft Windows XP Service Pack 2 (SP2) and Microsoft Windows XP Tablet PC Edition 2005, DEP is enforced by hardware and by software.
DEP will also prevent many installations from running, and has been known to cause other software issues. Please disable it as per the following steps:
From your Start menu, right-click on My Computer and select Properties.
In the System window, select Advanced system settings.
Go to the Advanced tab. Under Performance, hit the Settings button.
Select the Turn on DEP for essential…. button, as shown. Click OK. At this point it may be necessary to restart the machine.
Local Security Policy
If you are using workgroups instead of domains the following steps may need to be taken in order to establish communication. Please note that these changes may compromise the security of your system – speak with your network administrator if you have any concerns.
Go to Start > Control Panel > System and Security > Administrative Tools > Local Security Policy.
Go to Security Settings > Local Policies > Security Options.
Right-click on DCOM: Machine Access Restrictions… and select Properties.
Hit the Edit Security button, as shown.
Ensure that Everyone, Interactive, Network, and System are added into the allowed Group or User Names, as shown. Click OK to return to the main security policy window.
Right-click on DCOM: Machine Launch Restrictions… and select Properties.
Hit the Edit Security button, as shown.
Ensure that Everyone, Interactive, Network, and System are added into the allowed Group or User Names, as shown. Click OK to return to the main security policy window.
Browse to Network access: Let Everyone permissions apply to anonymous users. Right click on it, and select Properties.
Select Enabled and click OK.
Browse to Network access: Sharing and security model for local accounts. Right-click on it and select Properties.
Select Classic – local users authenticate as themselves and click OK.
