Windows Firewall blocking LSASS, causing DCOM launch error

Windows Firewall blocking LSASS, causing DCOM launch error

I am having a problem with several Windows Server 2003 SP1 servers on our 
domain that have the Windows Firewall service running, but Windows Firewall 
configured "off" (by domain policy). I turned on ALL auditing (since I don't 
know what I am looking for!) and see that Windows Firewall is blocking LSASS 
listening on a UDP port soon after a reboot. Oddly, nothing is logged in 
C:\Windows\pfirewall.log. It seems to be a random port number. Below are 
three example Event Log entries.

When I try to create a remote out of process DCOM object and the server is 
one of the affected servers, it fails to launch the process (DCOM Server 
Process Launcher cannot communicate with LSASS?) and I immediately get an 
E_ACCESSDENIED error returned. If I disable the Windows Firewall service and 
reboot, the problem does not occur. What is going on here? Thanks,

Paul

Event Type: Failure Audit
Event Source: Security
Event Category: Detailed Tracking
Event ID: 861
Date:  5/1/2008
Time:  11:55:53 AM
User:  NT AUTHORITY\SYSTEM
Computer: NCOALINK2
Description:
The Windows Firewall has detected an application listening for incoming 
traffic.

Name: -
Path: C:\WINDOWS\system32\lsass.exe
Process identifier: 716
User account: SYSTEM
User domain: NT AUTHORITY
Service: Yes
RPC server: No
IP version: IPv4
IP protocol: UDP
Port number: 1100
Allowed: No
User notified: No

For more information, see Help and Support Center at 
http://go.microsoft.com/fwlink/events.asp.

Event Type: Failure Audit
Event Source: Security
Event Category: Detailed Tracking
Event ID: 861
Date:  5/1/2008
Time:  11:52:08 AM
User:  NT AUTHORITY\SYSTEM
Computer: NCOALINK2
Description:
The Windows Firewall has detected an application listening for incoming 
traffic.

Name: -
Path: C:\WINDOWS\system32\lsass.exe
Process identifier: 716
User account: SYSTEM
User domain: NT AUTHORITY
Service: Yes
RPC server: No
IP version: IPv4
IP protocol: UDP
Port number: 1092
Allowed: No
User notified: No

For more information, see Help and Support Center at 
http://go.microsoft.com/fwlink/events.asp.

Event Type: Failure Audit
Event Source: Security
Event Category: Detailed Tracking
Event ID: 861
Date:  5/1/2008
Time:  11:52:08 AM
User:  NT AUTHORITY\SYSTEM
Computer: NCOALINK2
Description:
The Windows Firewall has detected an application listening for incoming 
traffic.

Name: -
Path: C:\WINDOWS\system32\lsass.exe
Process identifier: 716
User account: SYSTEM
User domain: NT AUTHORITY
Service: Yes
RPC server: No
IP version: IPv4
IP protocol: UDP
Port number: 1088
Allowed: No
User notified: No

For more information, see Help and Support Center at 
http://go.microsoft.com/fwlink/events.asp.

date: Thu, 1 May 2008 13:29:13 -0400 author: Paul Baker [MVP, Windows Desktop Experience] am

RE: Windows Firewall blocking LSASS, causing DCOM launch error

Hi Paul,

Does the 2003 SP1 server have more than one network adapter, even if it is 
disabled?  Is Routing and Remote access enabled on the server?

Have you checked your DCOM security configuration on Win2003 SP1? Win2003 
SP1 introduced the new "Distributed COM Users (Built in Group)". I see one 
internal similar case was resolved by adding the user into the "Distributed 
COM Users" group so that the user has the "remote activation" permission. 
Can you give it a try? 

The article below contains more details of the default DCOM security 
setting for various users and the security enhancement of Win2003 SP1:
"DCOM Security Enhancements in Windows XP Service Pack 2 and Windows Server 
2003 Service Pack 1"
http://msdn.microsoft.com/en-us/library/ms679714(VS.85).aspx

I will wait for your further information. Thanks.

Best regards,
Jeffrey Tan
Microsoft Online Community Support

Delighting our customers is our #1 priority. We welcome your comments and 
suggestions about how we can improve the support we provide to you. Please 
feel free to let my manager know what you think of the level of service 
provided. You can send feedback directly to my manager at: 
msdnmg@microsoft.com.

==================================================
Get notification to my posts through email? Please refer to 
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues 
where an initial response from the community or a Microsoft Support 
Engineer within 1 business day is acceptable. Please note that each follow 
up response may take approximately 2 business days as the support 
professional working with you may need further investigation to reach the 
most efficient resolution. The offering is not appropriate for situations 
that require urgent, real-time or phone-based interactions or complex 
project analysis and dump analysis issues. Issues of this nature are best 
handled working with a dedicated Microsoft Support Engineer by contacting 
Microsoft Customer Support Services (CSS) at 
http://msdn.microsoft.com/subscriptions/support/default.aspx.
==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

date: Fri, 02 May 2008 09:02:54 GMT author: (Jeffrey Tan[MSFT])