Diagnosing DCOM Problems

Looks like Windows XP SP2 and Windows Server 2003 (possibly only with SP1?) have added capabilities for logging information about DCOM activation failures and call failures. The document "Changes to Functionality in Microsoft Windows XP Service Pack 2" at http://www.microsoft.com/downloads/details.aspx?FamilyID=7bd948d7-b791-40b6-8364-685b84158c78&displaylang=en contains information about (among many other things!) the registry settings required to control the additional logging:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole]
"ActivationFailureLoggingLevel"=dword:00000001
"CallFailureLoggingLevel"=dword:00000001

Setting the values to 0 turns the logging off. For the change(s) to take affect, the DCOM server needs to be restarted. This may require rebooting the system, depending on what the DCOM server is.

The settings cause the following types of messages to be logged to the System event log.

The machine wide limit settings do not grant Remote Access permission for COM Server applications to the user NT AUTHORITY\ANONYMOUS LOGON SID
(S-1-5-7). This security permission can be modified using the Component Services administrative tool.

The machine wide limit settings do not grant Remote Activation permission for COM Server applications to the user NameSamCompatible SID ({sid}). This security permission can be modified using the Component Services administrative tool.

This allows one to determine what permissions need to be added to what accounts.

A knowledge base article that also documents these registry settings is:

Programs that use DCOM do not work correctly after you install Microsoft Windows Server 2003 Service Pack 1