Do not change the Launch and Activation permissions if you are running one of the newer Windows systems that supports enhanced DCOM security. With all the choices under the new fine-grained security model, it is too easy to get these wrong, or get them out of sync with the Access Permissions.

The asreg (Application Server Installer) utility will automatically synchronize your Launch and Activation Permissions to correspond to whatever you set in the Access Permissions. Therefore, edit only the Access Permissions (described in Security Tab Page—Launch and Activation Permissions (see Security Tab Page: Access Permissions, see page Security Tab Page: Launch and Activation Permissions)). Then run asreg to take care of the other permissions. When you run asreg, be sure to click the Install button. Clicking the Uninstall button removes your access permission customizations, and the next time you click Install, all ASO and SPO permissions will revert to initial defaults.

If you are running an older version of Windows that does not support the enhanced DCOM security model, then asreg cannot help, and you will need to manually edit the Launch Permissions for the ASO. But do not edit Launch Permissions for the SPO. If you make a mistake editing the Launch permissions for the SPO you can cause it to malfunction. The only account with launch permission for the SPO must be SYSTEM. Under the basic DCOM security model, there is no such thing as Activation Permission, and there is no distinction between local and remote permissions, so manually editing the ASO Launch Permissions is not difficult in that case.