Component Services Administration

You can use the Component Services snap-in in Microsoft Management Console (MMC) to configure and administer Component Object Model (COM) components, COM+ applications, and the Distributed Transaction Coordinator (DTC).

Component Services is designed both for system administrators and for application developers. For example, administrators can manage components, and developers can configure routine component and application behavior, such as participation in transactions and object pooling. For conceptual information and procedures that are not included here, see COM+ (Component Services) (http://go.microsoft.com/fwlink/?LinkId=67385).

  • Overview of Component Services Administration

  • Checklist: Configure the System for Component Services

  • Checklist: Manage COM+ Applications

  • Checklist: Manage DCOM Applications

  • Checklist: Manage Distributed Transactions

  • Configure the System for Component Services

  • Manage COM+ Applications

  • Manage DCOM Applications

  • Manage Distributed Transactions

  • User Interface: Component Services


Overview of Component Services Administration

Component Services focuses on the administration of COM+ applications. Developers use COM+ to develop distributed applications. Administrators use Component Services to manage those applications. An administrator receives a COM+ application file from a developer and then uses Component Services to deploy that application on a server computer. Next, the administrator configures permissions for the application, as well as other settings.

As an administrator, you can deploy and administer COM+ applications in two primary ways. You can use the Component Services snap-in in Microsoft Management Console (MMC), or you can write scripts to automate deployment and administration. As an alternative to using the Component Services MMC snap-in, you can automate any of the tasks by writing code that uses administration objects that are provided through the COMAdmin Library dynamic-link library (DLL). For a description of how to use these objects, see "Automating COM+ Administration" on COM+ General Tasks (http://go.microsoft.com/fwlink/?LinkId=66607).

For complete Component Services resources for developers, see COM+ (Component Services) (http://go.microsoft.com/fwlink/?LinkId=66575).

This topic provides an overview of the most commonly performed Component Services tasks and related concepts.

Component Services application types

Most Component Services administrative tasks involve deploying applications and components on the network and ensuring high performance and security for the deployed applications and components. The tasks that you perform depend on the type of application that you are working with and the services that the application uses.

Note

The topics that are included here cover only a portion of the settings that you can configure with the Component Services snap-in. Settings that are not covered in a topic should be configured only by someone with a thorough knowledge of the implementation of the component or application. Typically, these settings — which are discussed at COM+ (Component Services) (http://go.microsoft.com/fwlink/?LinkId=66575) — are made by the developer before the application is delivered for installation and deployment.

Applications that you administer with the Component Services snap-in fall into one of two categories: COM applications and COM+ applications. These terms are used in topics where settings may vary depending on the type of application.

COM applications

The idea of Component Object Model (COM) applications is not at all new. "COM" is simply the term that is used to refer to groups of COM components that were developed to work together. An example of a COM application is Microsoft® Office Excel®, which consists of a primary executable and accompanying application extension DLLs for the spell checker, Microsoft Visual Basic® functionality, and so on.

COM+ applications

COM+ applications are groups of COM components that were developed and configured together to make use of COM+ services such as transactions, queuing, role-based security, and so on. Some of what differentiates a COM+ application is written into the component code, and other differentiation is defined through the Component Services snap-in.

COM+ applications can be divided into two types, each with distinct administrative needs. The two types of applications are COM+ server applications and COM+ library applications. COM+ server applications run in their own process space. For example, a server application might consist of a group of DLLs that encapsulate payroll processing. COM+ library applications consist of components that were developed to run in a hosting application's process. For example, in a library application, you might group DLLs that provide services to other application components and DLLs that can share security characteristics of those components.

Administrative tasks overview

Administrative tasks that you perform with Component Services fall into four broad categories:

  • Configuring your system for Component Services

  • Making initial services settings

  • Installing and configuring COM+ applications

  • Monitoring and tuning component services

Note

While this topic examines tasks that are necessary or common, there are other tasks that you might perform as the need arises. For a more complete view of all tasks, see the documentation for the task areas that you are administering.

Configuring your system for Component Services

When you are getting started with COM+, there are a few customization tasks that you must perform before you can use the services with your network. For example, you must start by setting administrative security by assigning a user or group to the Administrator role of the System Application with Component Services. For more information, see Configure the System for Component Services.

Making initial services settings

When you have completed basic Component Services configuration for the characteristics of your network, your next task might be to adjust settings that are specific to the types of applications and services that you want to use on the network.

Examples of the types of settings that you might configure include the following:

  • To ensure security for components that are not configured into COM+ applications — that is, COM applications or COM components that are deployed independently — you may need to make specific COM security settings for those computers. (COM+ applications, on the other hand, can be designed to take advantage of role-based security.) For more information, see Manage DCOM Applications.

  • If your applications use distributed transactions, specify whether the Microsoft Distributed Transaction Coordinator (DTC) starts manually or automatically on each computer that runs it. Also, if transactions are used with Windows Clustering, you must configure the network appropriately. For more information, see Manage Distributed Transactions.

Installing and configuring COM+ applications

A COM+ application must be configured with settings that are specific to the services that it needs to use. After you configure the settings for the application, you can install its client-side and server-side portions to computers on the network. The following are examples of the types of tasks that you might perform to install and configure COM+ applications:

  • Before you can configure settings that govern how the COM+ application behaves on the network, install the application on a staging computer where you can configure it. For more information, see Understanding COM+ Application Installation.

  • To ensure that the COM+ application participates appropriately in your network's security scheme (that is, there is access both to the application and to other resources are appropriate to the needs of your network), you may have to add users to the application's roles and set the application's security identity. For more information, see Set Application-specific COM Security Configuration.

  • When you have configured the COM+ application with respect to security and the services that it needs to use, you must deploy its client-side and server-side portions to production computers across your network. For more information, see Manage COM+ Applications.

Monitoring and tuning Component Services

When you have deployed components that use Component Services, you can track those services to watch for performance enhancement opportunities and to handle failures. In some cases, changes that you make to these settings — particularly to achieve more-thorough monitoring — may actually decrease performance.

The following are examples of the types of tasks that you might perform to monitor and tune your components and applications:

  • Installing upgrades when they become available.

  • To enhance your control of security — for example, to keep objects from being accidentally or maliciously released — you can use reference tracking to make additional security checks and keep track of additional information.

  • If applications participate in distributed transactions, you can monitor performance by viewing transaction status, messages, and statistics. Also, you may be able to increase system performance by changing the size or location of the log file that stores transaction statistics.

For tasks related to monitoring and tuning that are not included here, see COM+ General Tasks (http://go.microsoft.com/fwlink/?LinkId=66607)


Checklist: Configure the System for Component Services

Task | Reference
Review basic concepts related to configuring the system for Component Services. | Configure the System for Component Services Understanding System Configuration
Set administrative security by assigning a user to the Administrator role of the System Application. | Set Administrative Security
Make computers visible to Component Services to manage COM+ applications and monitor transactions. | Make Computers Visible to Component Services
Enable DCOM to communicate with Component Object Model (COM) components on other computers. | Enable or Disable DCOM


Checklist: Manage COM+ Applications

Task | Reference
Create a new COM+ application. | Understanding COM+ Application Installation Create a New COM+ Application
Install COM+ server applications. | Understanding COM+ Application Installation Install COM+ Server Applications
Install COM+ application proxies. | Install COM+ Application Proxies
Remove COM+ applications. | Remove COM+ Applications


Checklist: Manage DCOM Applications

Task | Reference
Set computer-wide Component Object Model (COM) security. | Set Computer-wide Access Permissions Set Computer-wide Launch and Activation Permissions
Set application-specific COM security. | Set Application-specific Access Permissions Set Application-specific Launch and Activation Permissions


Checklist: Manage Distributed Transactions

Task | Reference
Review concepts related to distributed transaction management. | Manage Distributed Transactions Configure the Default Transaction Coordinator
Configure the default transaction coordinator to use the Distributed Transaction Coordinator (DTC) transaction manager of a remote system (not the local computer). | Configure the Default Transaction Coordinator
Control background tracing by selecting output options and logging options. | Configure DTC Tracing
Change the size or location of the DTC log file. | Configure DTC Logging
Configure DTC Security to allow only local transactions or to use a remote transaction coordinator. | Configure DTC Security
Coordinate remote transactions. | Configure DTC Security


Configure the System for Component Services

After you install the operating system, you must configure the system to enable Component Services administration on your network. You enable administrator control for the System Application. You also configure Component Services to recognize your network by making computers visible to Component Services and enabling component communication across computer boundaries by configuring DCOM. These configuration requirements are crucial to proper administration of Component Services.

Note

Depending on the needs of your system, it might be necessary to perform configuration tasks beyond the tasks that are described in the topics in this section. Although you may be able to configure the following properties at a later time, it is important to be aware of them early:

  • The Component Services snap-in requires the Distributed Transaction Coordinator (DTC) service to be running; therefore, you must configure the DTC. For more information, see Manage Distributed Transactions.

  • If enhancing system scalability is a goal for you, you can configure Component Services to shut down application processes that are not being used. For more information, see COM+ General Tasks (http://go.microsoft.com/fwlink/?LinkId=66607).

  • Understanding System Configuration

  • Set Administrative Security

  • Make Computers Visible to Component Services

  • Enable or Disable DCOM


Understanding System Configuration

This topic provides a general overview of the initial system configuration tasks that you perform with Component Services after you install the operating system.

Note

The Component Services snap-in requires the Microsoft Distributed Transaction Coordinator (DTC) service to be running. If the DTC is stopped and you attempt to change any settings by using the Component Services snap-in, the DTC service starts again. If error messages appear when you attempt to use the Component Services snap-in, verify that the DTC is started. If the DTC is not started, start it again in the Services MMC snap-in. To open the Services snap-in, click Start, point to Administrative Tools, and then click Services.

Setting control on the system application

The System Application folder is located in the COM+ Applications folder of the Component Services snap-in. The System Application manages configuration and deployment in Component Services. To guard access to this important application, you must define who can administer the environment. This step is necessary for making any changes to your Component Services configuration, including installing an application or adding a computer.

The System Application uses role-based security with roles such as Administrator, Reader, Server Application, Any Application, and QC Trusted User. Members of the Administrator role have Read and Write access to the System Application. They can add, change, or delete any of the settings in the Component Services snap-in. Only members of the Administrator role can install COM+ applications on the system. By default, the local Administrators group is the only member of this role. Only users who belong to the local Administrators group can be added to the Administrator role.

Note

You must assign at least one user or group to the Administrator role; otherwise, no one can administer Component Services.

Members of the Reader role have read-only access to the System Application. They can view settings in the Component Services snap-in, but they cannot change, add, or delete anything. By default, Everyone belongs to this role, meaning that anyone who has access to the computer can view the Component Services settings.

Note

For security reasons you might not want members of the Everyone group to be able to view the Component Services settings. If so, you should delete Everyone from the Reader role and add only those users to whom you want to assign Read access to the Component Services settings. You must restart the computer for the changes to take effect.

Members of the Server Application role are allowed to run COM+ server applications, while members of the Any Application role are allowed to run both COM+ server and COM+ library applications. By default, Everyone belongs to each role.

Members of the QC Trusted User role are trusted to transmit messages for queued components on behalf of other users. By default, this role has no members.

Note

Members of the QC Trusted User role are allowed to specify an arbitrary identity, which means that a malicious member could execute a queued component call with elevated privileges. It is therefore recommended that the number of such users be kept to an absolute minimum.

To set administrative security on the System Application, see Set Administrative Security.

Making computers visible to Component Services

You can manage COM+ applications and their transactions remotely, but first you must make the remote computer visible to Component Services. Add any computer that you want to administer to the console tree of the Component Services snap-in. To add computers to Component Services, see Make Computers Visible to Component Services.

Configuring DCOM

The DCOM wire protocol handles all network communication between Component Object Model (COM) components running on separate computers. You must enable DCOM for each computer with COM components that communicate with other components across the network. Although disabling DCOM has no effect on communication between components on the same computer, all communication is disabled between components on separate computers when DCOM is disabled. To enable component communication across computer boundaries, see Enable or Disable DCOM.

Additional references

  • Configure the System for Component Services


Set Administrative Security

System Application is located in the COM+ Applications folder in the Component Services snap-in. System Application manages configuration and deployment in Component Services. The default authentication level that System Application uses for calls is Packet Privacy, which provides the highest level of security.

Note

For security reasons it is strongly recommended that the Authentication Level of System Application remain at its default value of Packet Privacy.

So that changes to the system — such as installing a COM+ application or adding a computer — can be made, security must be set to define who can administer the environment. You can use the following procedure to enable security on System Application by defining who belongs to the Administrator role. Only members of the Administrators group on your computer can belong to the Administrator role of System Application.

Membership in Administrators, or equivalent, is the minimum required to complete this procedure. Review the details in "Additional considerations" in this topic.

To set administrative security by assigning a user or group to the Administrator role of System Application

  1. Open Component Services.

  2. In the console tree, double-click Computers and My Computer.

  3. Double-click COM+ Applications, System Application, Roles, and Administrator.

  4. Under Administrator, right-click the Users folder, point to New, and then click User.

  5. In the Select Users or Groups dialog box, in Enter the object names to select, type the fully qualified name of the user or group that you want to add. If you do not know the name of the user or group that you want to add, do the following:

    1. Click Locations, select the appropriate domain, and then click OK.

    2. In the Select Users or Groups dialog box, click Advanced.

    3. To view a list of users and groups in the selected domain, in the Select Users or Groups dialog box, click Find Now.

    4. Select a user or group, and then click OK.

  6. To add more user accounts or groups, repeat steps a through d.

  7. Restart the computer.

Additional considerations

  • Component Services is no longer in Administrative Tools. To open Component Services, click Start. In the search box, type dcomcnfg, and then press ENTER.

  • To enable administrative security on System Application, you must assign at least one user or group to the Administrator role. If you do not do this, no one can administer Component Services.

  • Users in the Administrator role for System Application must be members of the local Administrators group.

Additional references

  • Configure the System for Component Services


Make Computers Visible to Component Services

If you have sufficient privileges on a remote computer, you can manage its COM+ applications and monitor its transactions by using Component Services on your own computer, but first you must make the remote computer visible to Component Services. Use the following procedure to add any computer that you want to administer to the console tree of the Component Services snap-in.

Membership in Administrators, or equivalent, is the minimum required to complete this procedure. Review the details in "Additional considerations" in this topic.

To add a remote computer to the Component Services snap-in

  1. Open Component Services.

  2. In the console tree, right-click Computers, point to New, and then click Computer.

  3. In the Add Computer dialog box, type the name of the computer that you want to add. If you do not know the name of the computer, do the following:

    1. Click Browse, and then click Advanced in the Select Computer dialog box.

    2. To narrow the search for the computer, under Common Queries, fill in as many fields as possible. To view a list of computers that meet the criteria that you specified, click Find Now.

    3. Select a computer, and then click OK.

  4. Click OK twice.

    The computer now appears in the Computers folder. By using the Component Services snap-in, you can now manage objects on the remote computer in the same way that you manage objects on the local computer.

Additional considerations

  • Component Services is no longer in Administrative Tools. To open Component Services, click Start. In the Search box, type dcomcnfg, and then press ENTER.

  • To see processes that are running on a remote computer, add TCP port 135 and Dllhost.exe to the Windows Firewall exceptions list on the remote computer that is being administered. Add TCP port 135 and Microsoft Management Console (MMC) to the Windows Firewall exceptions list on the local computer.

You can also use the following procedure to remove a remote computer from the Component Services snap-in.

To remove a remote computer from the Component Services snap-in

  1. Open Component Services.

  2. In the console tree, click Computers.

  3. In the details pane, right-click the computer that you want to remove, and then click Delete.

Additional considerations

  • Component Services is no longer in Administrative Tools. To open Component Services, click Start. In the search box, type dcomcnfg, and then press ENTER.

Additional references

  • Configure the System for Component Services


Enable or Disable DCOM

If the computer using Component Services is part of a network, Component Services needs the DCOM wire protocol to communicate with Component Object Model (COM) components on other computers. In a Windows-based system, by default, network computers are initially configured to enable DCOM. You can disable DCOM, but doing so disables communication with components on other computers.

You can use the following procedure to enable or disable DCOM.

Membership in Administrators, or equivalent, is the minimum required to complete this procedure.

To enable or disable DCOM

  1. Open Component Services.

  2. In the console tree, click the Computers folder, right-click the computer for which you want to enable or disable DCOM, and then click Properties.

  3. Click the Default Properties tab.

  4. To enable DCOM, select the Enable Distributed COM on this computer check box. To disable DCOM, clear this check box.

  5. Click OK.

Additional considerations

  • Component Services is no longer in Administrative Tools. To open Component Services, click Start. In the search box, type dcomcnfg, and then press ENTER.

  • When you enable the DCOM service, you also have to configure the firewall on both the computer running the component as well as the computer running Component Services. For details about configuring the firewall for DCOM, see Using Distributed COM with Firewalls (http://go.microsoft.com/fwlink/?LinkId=38001).

  • If you disable DCOM on a remote computer, you cannot remotely access that computer to enable DCOM again. To enable DCOM again, you must have physical access to that computer.

Additional references

  • Configure the System for Component Services


Manage COM+ Applications

COM+ extends the component programming model. You can use COM+ to add useful functionality to a configured component. The added functionality includes role-based security, queuing, process recycling, and accessibility through Simple Object Access Protocol (SOAP).

Many of the tasks that system administrators perform relate to:

  • Installing server applications on staging computers and production computers.

  • Installing application proxies on client computers.

  • Removing or updating applications.

Administrators can perform these tasks by using the Component Services snap-in. Administrators can also automate these tasks through the Windows Script Host (WSH). Installing a COM+ application typically involves working with components and prebuilt COM+ applications on a staging computer that is used to develop and test the application. For more information about staging computers, see Understanding COM+ Application Installation.

Before you begin the installation process, assign users or groups to the Administrator role. For more information, see Set Administrative Security.

For tasks that are related to managing COM+ applications that are not included in this section, see COM+ (Component Services) (http://go.microsoft.com/fwlink/?LinkId=66575)

The following topics provide concepts and procedures for COM+ application installation tasks that you may need to perform.

  • Understanding COM+ Application Installation

  • Create a New COM+ Application

  • Install COM+ Server Applications

  • Install COM+ Application Proxies

  • Remove COM+ Applications


Understanding COM+ Application Installation

COM+ application installation overview

You can develop COM+ applications in your own organization, where the developer has full knowledge of the target environment: user accounts, user groups, server names, and so on. The developer configures and exports the application. The administrator simply installs the application on the target system.

You can also purchase COM+ applications from a non-Microsoft application vendor. If the application vendor does not provide a regular installation program that guides you through the required installation steps, you must install and configure the COM+ application yourself.

Configuration of a COM+ application is often performed on a staging computer rather than on production computers. If you use a staging computer, you must export the configured COM+ application and a COM+ application proxy from the staging computer and install them on the production computers.

Manual installation of a COM+ application includes the following primary steps. Depending on how the application vendor or developer chooses to provide the application, not all of these steps may be required. For more information, refer to any information that might be provided with the application.

  1. On the staging computer, configure the COM+ application for a specific target environment.

  2. Export environment-specific, client-side installation files and server-side installation files from the staging computer.

  3. Install the COM+ application or COM+ application proxy on the production computers.

For procedures to complete these steps, see Manage COM+ Applications.

Staging and production computers

It is useful to install and test applications in a staging environment that you can use to simulate scenarios that are likely to occur after the applications are deployed on production computers that are used by other people on the network.

You can also use staging environments to manage versioning and to update components. Rather than changing configurations or updating individual components for an application on production computers, you can modify the application, test it on a staging environment, and then export it as a unit to be installed on the production computers.

In some cases, configuration is identical between the staging environment and the production environment, and the only difference is that the staging environment is not publicly accessible. In these cases, you can simply replicate the configured and validated application from the staging environment to the production environment.

Updating COM+ application versions

As COM+ applications become dated or are no longer used, you must update or remove them. If you want to upgrade a COM+ application, you must first delete the previously installed version and then install the updated application.

To remove and then install applications, see Remove COM+ Applications and Install COM+ Server Applications.

Server-side installation for COM+ applications

All the necessary information for a COM+ server application is contained in a server application file (.msi). You can use the Component Services snap-in or the Windows Installer to install the COM+ application from the .msi file.

To prevent unauthorized modifications of your exported applications, store server application files only in directories with restricted Write permissions. For additional security, sign your server application files using Authenticode™. For more information about using Authenticode, see Authenticode (http://go.microsoft.com/fwlink/?LinkId=66679).

If a component in a COM+ application requires the installation or configuration of other resources — database connections, data or text files, Internet Information Services (IIS) virtual root configuration, and so on — these resources must be installed by using tools or utilities other than Component Services.

To install a COM+ application, see Install COM+ Server Applications.

Client-side installation for COM+ applications

After a COM+ server application is installed on a computer, it may be necessary to access the application remotely by using DCOM or Message Queuing.

If you want an application to be accessed remotely, you can use the Component Services snap-in to export a COM+ application proxy. The application proxy file (.msi) contains the necessary information to remotely access classes in a COM+ server application from a client computer through DCOM. By using the application proxy file with the Component Services snap-in, you can install the COM+ application proxy on the client computers in your site.

It is possible to create an application proxy that accesses a different server than the computer from which it was exported. This is useful when the application proxy for a production computer must be exported from a staging computer. To change the server name, click the Options tab on the properties sheet for the computer in the Component Services snap-in, and then enter the correct application proxy remote server name (RSN).

To install COM+ application proxies, see Install COM+ Application Proxies.


Create a New COM+ Application

When you develop COM+ applications, the principal tasks include designing Component Object Model (COM) components to encapsulate application logic and integrating these components into a COM+ application. You can integrate the components into an existing COM+ application, or you can create a new (empty) application for the components. You can use the Component Services snap-in to create new, empty COM+ applications.

Important

You cannot install a COM+ server application on computers running operating systems earlier than Microsoft Windows® 2000. A COM+ server application requires a platform that supports Component Services.

The minimum configuration for an application is one in which security is not required. If security is required for the application, use the Component Services snap-in to set process-level security, or add users to predefined roles after the application has been created.

Membership in Administrators, or equivalent, is the minimum required to complete this procedure. Review the details in "Additional considerations" in this topic.

To create a new COM+ application

  1. Open Component Services.

  2. In the console tree, locate the COM+ Applications folder that is associated with the computer on which you want to create the application.

  3. Right-click the COM+ Applications folder, point to New, and then click Application.

  4. In the COM+ Application Install Wizard, click Next.

  5. On the Install or Create a New Application page, click Create an empty application.

  6. On the Create Empty Application page, type a name for the new application. Under Activation Type, click either Library application or Server application, and then click Next.

  7. On the Set Application Identity page, under Account, click an account that the application identity will be set to, and then click Next.

    Note

    The default selection is Interactive user. The interactive user is the user who is logged on to the Windows account for the computer that runs the application. To choose a different user, click This user, and then enter the information for a specific user or group.

  8. On the Add Application Roles page, click Add role to specify any roles that you want to create for the application. By default, a single role named CreatorOwner is created.

  9. Click Next.

  10. To add the desired users to the roles that you have created, on the Add Users to Roles page, double-click a role name, click the Users folder, and then click Add. By default, your user account is added to the CreatorOwner role.

  11. Click Next, and then click Finish.

    The new application now appears in the console tree.

Additional considerations

  • Component Services is no longer in Administrative Tools. To open Component Services, click Start. In the search box, type dcomcnfg, and then press ENTER.

  • To perform this procedure, you must be a member of the Administrator role on the target computer's System Application. In the default configuration, only local computer administrators are assigned to this role. For more information, see Set Administrative Security.

  • If you want unauthenticated network users to run a COM+ application, the application roles must include the Anonymous user. In Microsoft Windows Vista®, by default the Anonymous user is not included in the Everyone group. You can add this type of user in the COM+ Application Install Wizard when you install or create a new application. In the wizard, on the Add Application Roles page, click Add role, type ANONYMOUS LOGON, and then click OK.

Additional references

  • Manage COM+ Applications


Install COM+ Server Applications

You can use the Component Services snap-in to install COM+ server applications.

Important

You cannot install a COM+ server application on computers running operating systems earlier than Windows 2000. A server application requires a platform that supports Component Services.

The minimum configuration for an application is one in which security is not required. If security is required for the application, use the Component Services snap-in to set process-level security, or add users to predefined roles after the application has been installed. For more information about how to configure security for your application see COM+ Security (http://go.microsoft.com/fwlink/?LinkId=66688).

Important

If you want to allow unauthenticated network users to run a COM+ application, the application roles must include the Anonymous user. In Windows Vista, by default the Anonymous user is not included in the Everyone group. You can add the role of ANONYMOUS LOGON in the COM+ Application Install Wizard when you install or create a new application.

Membership in Administrators, or equivalent, is the minimum required to complete this procedure. Review the details in "Additional considerations" in this topic.

Installing COM+ server applications

  • Using the Component Services snap-in

  • Using Windows Explorer

  • Using a command line

To install a COM+ server application using the Component Services snap-in

  1. Open Component Services.

  2. In the console tree, locate the COM+ Applications folder that is associated with the computer on which you want to install the application.

  3. Right-click the COM+ Applications folder, point to New, and then click Application.

  4. In the COM+ Application Install Wizard, click Next.

  5. On the Install or Create a New Application page, click Install pre-built application(s).

  6. In the Install from application file dialog box, browse to and select the .msi file for the application that you are installing, and then click Open.

  7. In the Select Application Files dialog box, click Add to browse for any additional applications that you want to install, and then click Next.

  8. On the Set Application Identity page, click the application identity, and then click Next.

    Note

    The default selection is Interactive user. The interactive user is the user who is logged on to the Windows account for the computer that runs the application. To select a different user, click This user, and then enter details for a specific user or group.

  9. On the Application Installation Options page, specify the directory in which to install the COM+ application, and then click Next.

    The application's component files are copied from the .msi file to the installation directory. The default installation directory is:

    %Program Files%\COMPlus Applications\appid

    You can either accept the default directory or click Specific directory and then search for another location.

    Note

    To perform this procedure, the application identity that is specified in previous step must have at least Read access to the installation directory, and the person performing the installation must have Write access to the installation directory.

  10. Click Finish. The Component Services console tree now shows the new application. If you install multiple applications, the options that you choose in step 9 apply to all the applications.

Additional considerations

  • Component Services is no longer in Administrative Tools. To open Component Services, click Start. In the search box, type dcomcnfg, and then press ENTER.

  • To perform this procedure, you must be a member of the Administrator role on the target computer's system application. In the default configuration, only local computer administrators are assigned to this role. For more information, see Set Administrative Security.

You can also install a COM+ application by dragging an application file from Windows Explorer to the details pane of the Component Services snap-in while the COM+ Applications folder of a computer is open.

To install a COM+ server application using Windows Explorer

  1. On the computer on which you want to install the COM+ application, use Windows Explorer to locate the server application file (.msi). The file can reside locally or on a network shared resource.

  2. Double-click the server application file. You can also right-click the file name, and then click Install. Microsoft Windows Installer automatically installs the server application on the target computer.

Additional considerations

  • To perform this procedure, you must be a member of the Administrator role on the target computer's system application. In the default configuration, only local computer administrators are assigned to this role. For more information, see Set Administrative Security.

To install a COM+ server application using a command line

  • At the command prompt, type the following, and then press ENTER:

    msiexec -i [<property overrides>] <application name>.msi

    Value Description

    property overrides

    In addition to the standard Windows Installer property overrides, you can specify the following option to change the installation directory for the COM+ application from the default to the specified directory:

    TARGETDIR = <target installation directory>

    application name

    The name of the application to be installed.

Additional considerations

  • To perform this procedure, you must be a member of the Administrator role on the target computer's system application. In the default configuration, only local computer administrators are assigned to this role. For more information, see Set Administrative Security.

Additional references

  • Manage COM+ Applications

  • Command-line syntax notation


Install COM+ Application Proxies

After the application proxy is created as a Windows Installer (.msi) file, you can install it on a client computer. Installing the application proxy provides the registration information that is necessary for client applications to access the COM+ application remotely from the client computer.

Important

You can install a COM+ application proxy on any computer running Windows Installer. Windows Installer is automatically installed on all computers running Windows 2000, Microsoft Windows Server™ 2003, or Windows Server 2008, and it is also available for computers running earlier versions of Windows. However, if an application proxy requires the COM+ Queued Components service, the application proxy can be installed only on a computer running Windows 2000, Windows Server 2003, or Windows Server 2008. The Queued Components service is available only on platforms that support Component Services.

Membership in Administrators, or equivalent, is the minimum required to complete this procedure. Review the details in "Additional considerations" in this topic.

Installing COM+ application proxies

  • Using the Component Services snap-in

  • Using Windows Explorer

  • Using a command line

To install a COM+ application proxy using the Component Services snap-in

  1. Open Component Services.

  2. In the console tree, locate the COM+ Applications folder that is associated with the computer on which you want to install the application.

  3. Right-click the COM+ Applications folder, point to New, and then click Application.

  4. In the COM+ Application Install Wizard, click Next.

  5. On the Install or Create a New Application page, click Install pre-built application(s).

  6. In the Install from application file dialog box, browse to select the .msi file for the application proxy that you are installing, and then click Open.

  7. On the Select Application Files page, click Add to browse for any additional application proxies that you want to install, and then click Next.

  8. On the Application Installation Options page, specify the directory in which you want to install the COM+ application proxy, and then click Next.

    The application's component files are copied from the .msi file to the installation directory. The default installation directory is:

    %Program Files%\COMPlus Applications\appid

    You can either accept the default directory or click Specific directory and search for another location.

  9. Click Finish. The Component Services console tree now shows the new application. If you install multiple applications, the directory that you choose in step 8 is used for all the applications.

Additional considerations

  • Component Services is no longer in Administrative Tools. To open Component Services, click Start. In the search box, type dcomcnfg, and then press ENTER.

  • To install a COM+ application proxy, you must have Write access to the installation directory.

To install a COM+ application proxy using Windows Explorer

  1. On the client computer, locate the application proxy file (.msi) using Windows Explorer. This file can reside locally or on a network shared resource.

  2. Double-click the application proxy file. You can also right-click the file name, and then click Install.

    Windows Installer automatically installs the application proxy on the client computer.

Additional considerations

  • To install a COM+ application proxy, you must have Write access to the installation directory.

To install a COM+ application proxy using a command line

  • At the command prompt, type the following, and then press ENTER:

    msiexec -i [<property overrides>] <application_name>.msi

    Value Description

    property overrides

    In addition to the standard Windows Installer property overrides, you can specify the following option to change the installation directory for the COM+ application from the default to the specified directory:

    TARGETDIR = <target installation directory>

    application_name

    The name of the application to be installed.

In addition to the standard Windows Installer property overrides, you can specify the installer options that are described in the following table.

Installer option Description
REMOTESERVERNAME = <new target server>

Changes the server to which the client computer connects from the exported default to the specified new target server.

ALLUSERS = 0

Installs the application proxy only for the current user. By default, the application proxy is installed computer-wide.

TARGETDIR = <target installation directory>

Changes the installation directory for the COM+ application from the default to the specified directory.

Additional considerations

  • To install a COM+ application proxy, you must have Write access to the installation directory.

Additional references

  • Manage COM+ Applications

  • Command-line syntax notation


Remove COM+ Applications

As existing applications become outdated or are no longer being used, you may need to remove them. Deleting an application also deletes any components that are contained in the application. If these components depend on additional resources (database connections, data or text files, Internet Information Services (IIS) virtual root configuration, and so on), these resources must be removed by using tools or utilities other than the Component Services snap-in.

Note

If you delete a COM+ server application while it is running, the application shuts down without warning before it is deleted.

Membership in Administrators, or equivalent, is the minimum required to complete this procedure.

Removing COM+ Applications

  • Using the Component Services snap-in

  • Using Windows Explorer

  • Using a command line

To delete a COM+ application using the Component Services snap-in

  1. Open Component Services.

  2. In the console tree, double-click Computers, and then double-click the computer for which you want to delete an application.

  3. Double-click the COM+ Applications folder for the specified computer to display all the applications.

  4. Click the application that you want to remove.

  5. If you selected a server application, shut down the application. To do this, right-click the application, and then click Shut down. If you selected a library application, make sure that all processes that are currently using this library application are shut down.

  6. Right-click the application. If Delete is not an option when you right-click the application, you must enable deletion of the application by doing the following:

    1. Right-click the application, and then click Properties.

    2. In the application properties page, select the Advanced tab.

    3. Under Protection, clear the Disable deletion check box.

    4. Click OK.

  7. Right-click the application, and then click Delete.

  8. In the Confirm Item Delete dialog box, click Yes to delete the application.

Additional considerations

  • Component Services is no longer in Administrative Tools. To open Component Services, click Start. In the search box, type dcomcnfg, and then press ENTER.

The following procedures are especially useful for deleting COM+ applications on client computers that are not running the Component Services snap-in.

To delete a COM+ application using Windows Explorer

  1. On the computer on which you want to delete the COM+ application, use Windows Explorer to locate the server application file (.msi) or application proxy file (.msi).

  2. Right-click the .msi file, and then click Uninstall. Windows Installer automatically deletes the application.
To delete a COM+ application using a command line

  • At the command prompt, type the following, and then press ENTER:

    msiexec -x <application_name>.msi

    Value Description

    application_name

    The name of the application to be deleted.

Additional references

  • Manage COM+ Applications

  • Command-line syntax notation


Manage DCOM Applications

The Component Object Model (COM) enables functionality to be encapsulated in a COM application that can be reused by many different applications. DCOM technology enables a COM application to be accessed from different computers over a network.

Typically, COM and COM+ components are housed within dynamic-link libraries (DLLs) or executable (.exe) files. You can install these components on a client computer or on a remote computer. When you install these components on a remote computer, the call is made by DCOM, which is based on remote procedure calls (RPCs).

For tasks related to administering DCOM applications that do not appear here, see DCOM (http://go.microsoft.com/fwlink/?LinkId=66689).

  • Set Computer-wide COM Security Configuration

  • Set Application-specific COM Security Configuration


Set Computer-wide COM Security Configuration

The tasks that you perform initially for management of DCOM applications deal primarily with security settings. By using the Component Services snap-in, you can set the computer-wide Component Object Model (COM) security properties that are used by COM applications.

For more information about COM security settings, see Security in COM (http://go.microsoft.com/fwlink/?LinkId=66690).

  • Set Computer-wide Access Permissions

  • Set Computer-wide Launch and Activation Permissions


Set Computer-wide Access Permissions

Computer-wide access permissions specify the users who are assigned or denied access to COM applications. By using the Component Services snap-in, you can change either the computer-wide default access permissions or the computer-wide restriction policy. This topic includes the procedure for setting computer-wide access permissions. For more information on computer-wide restriction policy, see Computer-wide Restrictions (http://go.microsoft.com/fwlink/?LinkId=67447).

Important

Modifying access permissions can affect the ability of applications to start, connect, function, or run securely. Therefore, we recommend that you modify application-specific permissions rather than change computer-wide default access permissions.

Membership in Administrators, or equivalent, is the minimum required to complete this procedure.

To set computer-wide access permissions

  1. Open Component Services.

  2. In Component Services, right-click the computer whose computer-wide access permissions you want to modify, and then click Properties.

  3. Click the COM Security tab.

  4. Under Access Permissions, click either Edit Limits or Edit Default, depending on whether you want to modify the computer-wide restriction policy or the computer-wide default settings. An Access Permission dialog box appears.

  5. To remove a user account or group, select the group or user in the Group or user names list, and then click Remove. The selected user account or group no longer appears in the list.

  6. To add a user account or group, click Add. In the Select Users, Computers, or Groups dialog box, type the fully qualified name of the user or group that you want to add.

    If you do not know the name of the user or group that you want to add, click Advanced, and then click Find Now to view a list of users and groups in the selected domain. Select a user or group in the list, and then click OK. The added user or group appears in the Group or user names list.

  7. In the Group or user names list, select the group or user whose computer-wide access permission you want to change.

  8. In the Permissions list, select the Allow or Deny check boxes to either allow or deny the local access permission and the remote access permission for the selected group or user name.

  9. Click OK to return to the COM Security tab.

  10. Click OK. The new computer-wide access permissions are applied the next time that an application on the computer is started. Applications that are currently running are not affected until they are restarted.

Additional considerations

  • Component Services is no longer in Administrative Tools. To open Component Services, click Start. In the search box, type dcomcnfg, and then press ENTER.

Additional references

  • Set Computer-wide COM Security Configuration


Set Computer-wide Launch and Activation Permissions

The computer-wide launch and activation permissions determine which users are explicitly assigned or denied permission to start and activate Component Object Model (COM) applications. By using the Component Services snap-in, you can change either the computer-wide default launch and activation permissions or the computer-wide restriction policy.

Important

Modifying launch and activation permissions can affect the ability of applications to start, connect, function, or run securely. Therefore, we recommend that you modify application-specific permissions rather than change default launch and activation permissions.

Membership in Administrators, or equivalent, is the minimum required to complete this procedure.

To set computer-wide launch and activation permissions

  1. Open Component Services.

  2. In the Component Services snap-in, right-click the computer whose computer-wide launch permissions you want to modify, and then click Properties.

  3. Select the COM Security tab.

  4. Under Launch and Activation Permissions, click either Edit Limits or Edit Default, depending on whether you want to modify the computer-wide restriction policy or the computer-wide default settings. A Launch and Activation Permission dialog box appears.

  5. To remove a user account or group, select the group or user in the Group or user names list, and then click Remove. The selected user account or group no longer appears in the list.

  6. To add a user account or group, click Add. In the Select Users, Computers, or Groups dialog box, type the fully qualified name of the user or group that you want to add. If you do not know the name of the user or group that you want to add, click Advanced, and then click Find Now to view a list of users and groups in the selected domain. Select a user or group in the list, and then click OK. The added user account or group appears in the Group or user names list.

  7. In the Group or user names list, select the group or user whose computer-wide launch and activation permissions you want to change.

  8. In the Permissions list, select the Allow or Deny check boxes to either allow or deny the Local Launch permission, Local Activation permission, Remote Launch permission, and Remote Activation permission for the selected group or user name.

  9. Click OK to return to the COM Security tab.

  10. Click OK. The new computer-wide launch and activation settings are applied the next time that an application on the computer is started. Applications that are currently running are not affected until they are restarted.

Additional considerations

  • Component Services is no longer in Administrative Tools. To open Component Services, click Start. In the search box, type dcomcnfg, and then press ENTER.

  • When you set permissions, you must ensure that SYSTEM is included in the Group or user names list in the Launch and Activation Permission dialog box and that SYSTEM is allowed the Launch permission. SYSTEM is included implicitly in the group Everyone. However, for security reasons, we recommend that you not enable the Launch permission for the Everyone group.

Additional references

  • Set Computer-wide COM Security Configuration


Set Application-specific COM Security Configuration

By using the Component Services snap-in, you can set Component Object Model (COM) security properties for a specific COM application.

For more information about how these security features work, see Security in COM (http://go.microsoft.com/fwlink/?LinkId=66690).

  • Set Application-specific Access Permissions

  • Set Application-specific Launch and Activation Permissions


Set Application-specific Access Permissions

Application-specific access permissions specify the users who are assigned or denied access to a Component Object Model (COM) application.

Membership in Administrators, or equivalent, is the minimum required to complete this procedure.

To set application-specific access permissions

  1. Open Component Services.

  2. In the console tree, right-click the DCOM application whose access permissions you want to modify, and then click Properties.

  3. Click the Security tab.

  4. Under Access Permissions, click Customize, and then click Edit.

  5. To remove a user account or group, select the group or user in the Group or user names list, and then click Remove. The selected user account or group no longer appears in the list.

  6. To add a user account or group, click Add. Then, in the Select Users, Computers, or Groups dialog box, type the fully qualified name of the user or group that you want to add. If you do not know the name, click Advanced, and then click Find Now to view a list of users and groups in the selected domain. Select a user or group in the list, and then click OK. The added user account or group appears in the Group or user names list.

  7. In the Group or user names list, select the group or user whose default access permission you want to change.

  8. In the Permissions list, select the Allow or Deny check boxes to either allow or deny the Local Access permission and the Remote Access permission for the selected group or user name.

  9. Click OK twice. The new application-specific access permissions apply the next time that the application is started on the computer.

Additional considerations

  • Component Services is no longer in Administrative Tools. To open Component Services, click Start. In the search box, type dcomcnfg, and then press ENTER.

Additional references

  • Set Application-specific COM Security Configuration


Set Application-specific Launch and Activation Permissions

Application-specific launch and activation permissions specify the users who are assigned or denied permission to start or activate a COM application.

Membership in Administrators, or equivalent, is the minimum required to complete this procedure.

To set application-specific launch and activation permissions

  1. Open Component Services.

  2. In the Component Services snap-in, right-click the DCOM application whose access permissions you want to modify, and then click Properties.

  3. Select the Security tab.

  4. Under Launch and Activation Permissions, click the Customize button, and then click the Edit button.

  5. To remove a user account or group, select the group or user in the Group or user names list, and then click Remove. The selected user account or group no longer appears in the list.

  6. To add a user account or group, click Add. Then, in the Select Users, Computers, or Groups dialog box, in the bottom pane, type the fully qualified name of the user or group that you want to add. If you do not know the name of the user or group that you want to add, click Advanced, and then click Find Now to view a list of users and groups in the selected domain. Select a user or group in the list, and then click OK. The added user account or group appears in the Group or user names list.

  7. In the Group or user names list, select the group or user whose default access permission you want to change.

  8. In the Permissions list, select the Allow or Deny check boxes to either allow or deny the Local Launch permission, Local Activation permission, Remote Launch permission, and Remote Activation permission for the selected group or user name.

  9. Click OK twice. The new application-specific launch and activation permissions apply the next time that the application is started on the computer.

Additional considerations

  • Component Services is no longer in Administrative Tools. To open Component Services, click Start. In the search box, type dcomcnfg, and then press ENTER.

Additional references

  • Set Application-specific COM Security Configuration


Manage Distributed Transactions

The Distributed Transaction Coordinator (DTC) service coordinates transactions that update transaction-protected resources, such as databases, message queues, file systems, and so on. These transaction-protected resources may be contained on a single system or distributed across a network of systems.

By using the Component Services snap-in, you can configure your computers to support local, remote, and distributed transactions. You can also monitor and manage all transactions with Component Services.

Transaction management

Component Services provides several features that administrators can use to perform basic administration of the DTC transaction manager on a local computer and on remote systems.

When you administer transactions, first configure which DTC will coordinate transactions for applications that are running on your computer. By default, all transactions on a computer are coordinated by the computer’s local DTC transaction manager. You can also configure your computer to direct all transaction-coordination traffic to the DTC transaction manager of a remote computer.

The next major task in administering transactions is to configure the DTC that is coordinating your transactions. You can use Component Services to administer the local DTC transaction manager or the transaction manager on a remote computer. You can access the properties sheet of the local DTC in the console tree of the Component Services snap-in, as follows:

Component Services\Computers\Computer Name\Distributed Transaction Coordinator

Configuration tasks include starting and stopping tracing, changing log size and location, and changing various security settings for the DTC transaction manager.

Component Services also provides Transaction List and Transaction Statistics utilities for the DTC transaction manager. You can use these utilities to view and change the status of transactions that are governed by the DTC transaction manager.

For information about DTC tasks that are not included here, see the DTC Administration Guide (http://go.microsoft.com/fwlink/?LinkId=66713).

  • Configure the Default Transaction Coordinator

  • Configure DTC Tracing

  • Configure DTC Logging

  • Configure DTC Security


Configure the Default Transaction Coordinator

By default, each system uses its local Distributed Transaction Coordinator (DTC) transaction manager for initiating and coordinating transactions. However, you can configure your computer to use the DTC transaction manager of another system as the default transaction coordinator. The DTC transaction manager on the specified system is used as the transaction coordinator whenever a client on the local system begins a DTC transaction and that client does not explicitly specify a transaction coordinator. The default transaction coordinator coordinates all transactions that are initiated by COM+ or any other client that uses transactions. The default transaction coordinator also serves as the transaction coordinator for all resource managers on the local system that enlist in any DTC transaction.

The system that you select as the default transaction coordinator should be reliable. The network connection to the default transaction coordinator system should also be reliable. Otherwise, specification of a default transaction coordinator might reduce the availability of the DTC on your local system.

If you decide to use a remote default transaction coordinator, both your computer and the remote transaction coordinator must be configured to allow network DTC access. To allow network DTC access, see Configure DTC Security.

Membership in Administrators, or equivalent, is the minimum required to complete this procedure. Review the details in "Additional considerations" in this topic.

To designate a remote system as the default transaction coordinator

  1. Open Component Services.

  2. In the Component Services snap-in, right-click the computer whose transaction coordinator settings you want to change (for example, My Computer), and then click Properties.

  3. In the properties dialog box for the computer, click the MSDTC tab.

  4. Clear the Use local coordinator check box.

  5. In Remote coordinator host name, type the remote system name. If you are not sure of the exact name, click Select to display a list of all computers on the network, and then select the computer that you want in the list.

  6. Click OK.

Additional considerations

  • Component Services is no longer in Administrative Tools. To open Component Services, click Start. In the search box, type dcomcnfg, and then press ENTER.

  • To configure the default transaction coordinator, you must have administrator credentials on both the local system and the system that you are designating as the default coordinator. This makes it possible for the local DTC system to retrieve the appropriate information from the system registry on the default transaction coordinator system.

To designate the local system as the default transaction coordinator

  1. Open Component Services.

  2. In the console tree, right-click the computer that you want to designate as the default transaction coordinator, and then click Properties.

  3. In the properties dialog box for the computer, click the MSDTC tab.

  4. Select the Use local coordinator check box.

  5. Click OK.

Additional considerations

  • Component Services is no longer in Administrative Tools. To open Component Services, click Start. In the search box, type dcomcnfg, and then press ENTER.

  • To configure the default transaction coordinator, you must have administrator credentials on both the local system and the system that you are designating as the default coordinator. This makes it possible for the local DTC system to retrieve the appropriate information from the system registry on the default transaction coordinator system.


Configure DTC Tracing

You can configure background tracing with the Local DTC Properties sheet in the Component Services snap-in. You can use this interface to configure background tracing only; you cannot use it to control the tracing of individual transactions or to control trace settings remotely. To configure Distributed Transaction Coordinator (DTC) tracing, you can select output options and logging options. You can use logging options to control the log file for the trace data.

Membership in Administrators, or equivalent, is the minimum required to complete this procedure.

To configure DTC tracing

  1. Open Component Services.

  2. In the Component Services snap-in, double-click Computers, Computer Name, and Distributed Transaction Coordinator.

  3. Right-click Local DTC, and then click Properties.

  4. On the Tracing tab, under Output Options, select or clear the check boxes for the output options that you want.

  5. Under Logging Options, click New Session, Stop Session, or Flush Data as appropriate.

    As an option, you can also enter a value in Change the Max Num. Of Memory Buffers (size Page Size).

  6. Click OK.

Additional considerations

  • Component Services is no longer in Administrative Tools. To open Component Services, click Start. In the search box, type dcomcnfg, and then press ENTER.

Additional references

  • Manage Distributed Transactions


Configure DTC Logging

You can configure the location and size of the Distributed Transaction Coordinator (DTC) log file.

Caution

If you change the size of the DTC log file, the current log file is destroyed and a new log file is created. Before you alter the log file, verify that the existing log file can be deleted safely by ensuring that there are no transactions in the In Doubt, Cannot Notify Abort, or Cannot Notify Commit state. For more information about managing DTC log files, see DTC Log File Management (http://go.microsoft.com/fwlink/?LinkId=66753).

Important

Before you configure the log file, stop the DTC in the Services snap-in. If you do not stop the DTC, your attempt to reset the log file generates a DTC console message indicating that the DTC service needs to be stopped and restarted to perform the requested action.

Membership in Administrators, or equivalent, is the minimum required to complete this procedure.

To configure DTC logging

  1. Open Component Services.

  2. In the console tree, double-click Computers, Computer Name, and Distributed Transaction Coordinator.

  3. Right-click Local DTC, and then click Properties.

  4. To change the log file location, click the Logging tab. In Location, type the new path for the log file. If you do not know the full path, click Browse to select a log file location.

  5. To change the log file size, in Capacity, type the new log file size in megabytes (MB).

  6. Click OK.

Additional considerations

  • Component Services is no longer in Administrative Tools. To open Component Services, click Start. In the search box, type dcomcnfg, and then press ENTER.

Additional references

  • Manage Distributed Transactions


Configure DTC Security

You can configure the security requirements for distributed transactions in which your computer participates. The default security settings do not allow your computer to participate in remote distributed transactions.

Important

  • By default, DTC runs under the NetworkService account. This account is specifically designed to allow services such as the Distributed Transaction Coordinator service to run with the appropriate set of privileges. To minimize potential security problems and ensure that the DTC service runs, we recommend that you use the default NetworkService account. Alternately, a domain user account can be used.

  • If you enable Distributed Transaction Coordinator (DTC) network transactions on a computer that has Windows Firewall enabled, you must also configure the computer to allow DTC traffic through the firewall. For more information about Windows Firewall, see Managing Program, Port, and System Service Exceptions (http://go.microsoft.com/fwlink/?LinkId=67467).

Membership in Administrators, or equivalent, is the minimum required to complete this procedure.

To configure DTC Security to allow only local transactions

  1. Open Component Services.

  2. In the Component Services snap-in, double-click Computers, Computer Name, and Distributed Transaction Coordinator.

  3. Right-click Local DTC, click Properties, and then click the Security tab.

  4. Under Security Settings, clear the Network DTC Access check box.

  5. Continue to configure security settings, or click OK.

Additional considerations

  • Component Services is no longer in Administrative Tools. To open Component Services, click Start. In the search box, type dcomcnfg, and then press ENTER.

To configure DTC Security to use a remote transaction coordinator

  1. Open Component Services.

  2. In the Component Services snap-in, double-click Computers, Computer Name, and Distributed Transaction Coordinator.

  3. Right-click Local DTC, click Properties, and then click the Security tab.

  4. Under Security Settings, select the Network DTC Access check box.

  5. Under Transaction Manager Communication, select the Allow Inbound and Allow Outbound check boxes.

  6. Select an authentication level for DTC communications. Mutual Authentication Required is the most secure level.

  7. Continue to configure security settings, or click OK.

Additional considerations

  • Component Services is no longer in Administrative Tools. To open Component Services, click Start. In the search box, type dcomcnfg, and then press ENTER.

To coordinate remote transactions

  1. Open Component Services.

  2. In the Component Services snap-in, double-click Computers, Computer Name, and Distributed Transaction Coordinator.

  3. Right-click Local DTC, click Properties, and then click the Security tab.

  4. Under Security Settings, select the Network DTC Access check box.

  5. Under Client and Administration, select the Allow Remote Clients check box.

  6. Under Transaction Manager Communication, select the Allow Inbound and Allow Outbound check boxes.

  7. Select an authentication level for DTC communications. Mutual Authentication Required is the most secure level.

  8. Continue to configure security settings, or click OK.

Additional considerations

  • Component Services is no longer in Administrative Tools. To open Component Services, click Start. In the search box, type dcomcnfg, and then press ENTER.

To change the DTC logon account

  1. Open Component Services.

  2. In the Component Services snap-in, double-click Computers, Computer Name, and Distributed Transaction Coordinator.

  3. Right-click Local DTC, click Properties, and then click the Security tab.

  4. Under DTC Logon Account, enter the account under which the DTC will run, or click Browse to locate the account name. Type and then confirm the password for that account.

  5. Click OK.

Additional considerations

  • Component Services is no longer in Administrative Tools. To open Component Services, click Start. In the search box, type dcomcnfg, and then press ENTER.

Additional references

  • Manage Distributed Transactions


Using Windows Backup and Restore with DTC

Distributed Transaction Coordinator (DTC) fully complies with Windows Backup and Restore functionality.

However, backup and restore applies only to the local computer resources. Therefore, if there are active transactions spanning different computers, transactional consistency cannot be guaranteed.

To avoid problems, make sure that there are no incomplete transactions during backup or restore operations under the following conditions:

  • A computer is running as a remote DTC coordinator

    Use the following procedure "To determine if a computer is using a remote coordinator" to determine if the computer is using a remote coordinator. To resolve any incomplete transactions, use the following procedure "To view and resolve existing transactions."

  • A computer has an application that is participating in transactions spanning multiple computers

    Use the following procedure "To determine if a computer is using a remote coordinator" on the computer where the application is running to determine the transaction coordinator for that computer. To resolve any incomplete transactions, use the following procedure "To view and resolve existing transactions" on the computer where the coordinator is running.

To determine if a computer is using a remote coordinator

  1. Open the Component Services snap-in.

  2. Right-click the computer whose transaction coordinator settings you want to change (for example, My Computer), and then click Properties.

  3. In the properties dialog box for the computer, click the MSDTC tab.

  4. If the Use local coordinator check box is cleared, the computer name that is listed in Remote coordinator host name indicates the remote coordinator that is being used by the computer.

  5. Click OK.
To view and resolve existing transactions

  1. Open the Component Services snap-in on the computer that is acting as the coordinator for transactions.

  2. Double-click Computers, My Computer, Distributed Transaction Coordinator, and Local DTC, and then click Transaction List.

    The list view displays all incomplete transactions.

  3. To resolve an incomplete transaction, right-click the transaction, and then click Resolve. Select Commit, Abort, or Forget as necessary.


User Interface: Component Services

  • COM+ Applications <Application> Properties Sheet: Activation Tab

  • COM+ Applications <Application> Properties Sheet: Advanced Tab

  • COM+ Applications <Application> Properties Sheet: Dump Tab

  • COM+ Applications <Application> Properties Sheet: General Tab

  • COM+ Applications <Application> Properties Sheet: Identity Tab

  • COM+ Applications <Application> Properties Sheet: Pooling & Recycling Tab

  • COM+ Applications <Application> Properties Sheet: Queuing Tab

  • COM+ Applications <Application> Properties Sheet: Security Tab

  • DCOM Config <Application> Properties Sheet: Endpoints Tab

  • DCOM Config <Application> Properties Sheet: General Tab

  • DCOM Config <Application> Properties Sheet: Identity Tab

  • DCOM Config <Application> Properties Sheet: Location Tab

  • DCOM Config <Application> Properties Sheet: Security Tab

  • My Computer Properties Sheet: COM Security Tab

  • My Computer Properties Sheet: Default Properties Tab

  • My Computer Properties Sheet: Default Protocols Tab

  • My Computer Properties Sheet: General Tab

  • My Computer Properties Sheet: MSDTC Tab

  • My Computer Properties Sheet: Options Tab

  • Local DTC Properties Sheet: Logging Tab

  • Local DTC Properties Sheet: Security Tab

  • Local DTC Properties Sheet: Tracing Tab


COM+ Applications <Application> Properties Sheet: Activation Tab

Item Details

Activation type

Click Library application for an application that runs in the process of the client that creates it. It can be called only by clients that are located on the same computer.

Click Server application for an application that runs in its own dedicated server process.

If you change an application's activation type, other properties for the application are reset.

SOAP

If you select the Uses SOAP check box:

  • In SOAP VRoot, specify the Internet Information Services (IIS) virtual root directory where the components of this application are to be available as an XML Web service.

  • SOAP Security indicates whether COM+ role-based security is implemented for activations through Simple Object Access Protocol (SOAP).

Remote Server Name

Type the remote server name that is used by the application proxy. An application proxy directs client calls to a COM+ server application that is installed on a remote computer.

Application Root Directory

Type the full path of the directory that contains a valid side-by-side assembly manifest file that is used to create an activation context for the application. Applications use activation contexts to load a particular dynamic-link library (DLL) version, Component Object Model (COM) object instance, or custom window version.


COM+ Applications <Application> Properties Sheet: Advanced Tab

Item Details

Server Process Shutdown

You can configure a server process to shut down after it remains idle for a certain amount of time. This is a useful way to automatically free up resources that are no longer needed. Click one of the following options:

  • Click Leave running when idle to specify that the server process that is associated with the COM+ application remains running when there are no outstanding client calls. The application runs until it is shut down manually.

  • Click Enable idle shutdown to specify that the server process that is associated with the COM+ application shuts down automatically after a certain period of inactivity, which is determined by the number of minutes in the text box.

Protection

Select one or both of the following check boxes to protect the application from being deleted or changed:

  • Disable deletion

  • Disable changes

Debugging

Select the Launch in debugger check box to specify that a server application starts in the debugger when it is started, using the debugger command line that is specified in Debugger path.

Type the path and command line that is used for invoking the debugger when Launch in debugger is enabled. To search for the debugger, click Browse. Any command-line options for the debugger must be typed in the text box after the debugger is located.

Enable compensating resource managers

Select this check box to enable the server application to use a compensating resource manager (CRM). CRM components are available to the application only when this check box is selected.

Enable 3GB support

Select this check box to specify that the application can access up to 3 gigabytes (GB) of memory when the operating system has been configured to allow access to more than 2 GB of memory.


COM+ Applications <Application> Properties Sheet: Dump Tab

Item | Details
Image Dump Directory | Type the complete path to the dump file. Do not include the file name. The default path is %SystemRoot%\system32\com\dmp.
Maximum Number of Dump Images | Select the maximum number of files to be generated in the image dump directory before overwriting occurs. The number must be between 1 and 200. The default number is 5.
Enable Process Image Dump | Select the Enable Image Dump on Application Fault check box to dump a static image of the application when an exception occurs or when the application fails.


COM+ Applications <Application> Properties Sheet: General Tab

Item | Details
Description | You can type a description up to 500 characters long to help identify and manage the selected item.
Application ID | The globally unique identifier (GUID) of the selected COM+ application partition. The GUID is generated automatically when the COM+ partition is created. You can use it to identify particular versions of the partition on a computer.


COM+ Applications <Application> Properties Sheet: Identity Tab

Item Details

System Account option buttons

Click the option button for the account under which the application will run:

  • Interactive User: Click this button to specify that the application runs under the identity of the user who is currently logged on to the computer. This user's security credentials are used when the application is authenticated to access resources.

  • Local Service: Click this button to specify that the application runs under the Local Service account.

  • Network Service: Click this button to specify that the application runs under the Network Service account.

  • Local System: Click this button to specify that the application runs under the Local System account. This account gives the application complete access to the local computer.

This user option button

Click This user to specify that the application runs under the identity of a specified user account. This user's security credentials are used when the application is authenticated to access resources. Type the user name and password for the user.


COM+ Applications <Application> Properties Sheet: Pooling & Recycling Tab

Item Details

Application Pooling

In Pool Size, type the maximum number of application server processes that can run concurrently. The default number is 1, in which case the COM+ Application Pooling service is disabled.

Application Recycling

You can select values for the following options:

  • Lifetime Limit: The maximum number of minutes a process can run before it is recycled. The valid range is 0 minutes through 30,240 minutes (21 days).

  • Memory Limit: The maximum amount of process memory usage in kilobytes (KB) before the process is recycled. If the process's memory usage exceeds the specified number for longer than one minute, the process is recycled. The valid range is 0 KB through 1,048,576 KB. The default value is 0 KB.

  • Expiration Timeout: The number of minutes to wait for the release of all external references to objects in the process before is the process is forcibly shut down. The valid range is 1 minute through 1440 minutes (24 hours). The default value is 15 minutes. This value is used only when it is already determined that a process will be recycled based on the other criteria.

  • Call Limit: The maximum number of calls that the application objects can accept before the process is recycled. The valid range is 0 calls through 1,048,576 calls.

  • Activation Limit: The maximum number of application object activations to accept before the process is recycled. The valid range is 0 activations through 1,048,576 activations.


COM+ Applications <Application> Properties Sheet: Queuing Tab

Item | Details
MSMQ Message Authentication group box | Click Authenticate messages if authentication level for calls (on Security Property Page) is not NONE to authenticate messages from clients that request the services of this application only when Message Queuing checks the integrity of the requests. If Authentication Level for Calls (on the Security tab of the application properties sheet) is None, messages are not authenticated.
Maximum concurrent players | Type the maximum number of concurrent threads that are listening to this queue. When the maximum number is exceeded, messages wait in the queue for the next available thread.


COM+ Applications <Application> Properties Sheet: Security Tab

Items Details

Authorization

Select the Enforce access checks for this application check box to enforce role-based access checks for the application. When roles are defined for an application, a caller's role membership is checked on every call into the application.

Security Level

Click Perform access checks only at the process level to enable access checks only at the application level; no role checking is performed at the component, interface, or method levels. If the Enforce access checks for this application check box is not selected, this setting is ignored.

Click Perform access checks at the process and component level to enable access checks at every level on calls into the application. Role checking is performed at the application level and at the component, interface, and method levels for any component that has Enforce component level access checks selected on its component properties Security tab. If the Enforce access checks for this application check box is not selected, this setting is ignored.

Software Restriction Policy

Select the Apply software restriction policy check box to configure the trust level of the software restriction policy for this application in the Restriction Level drop-down box. If the check box is not selected, the system-wide configuration of the software restriction policy is used.

Authentication Level for Calls

When you set an authentication level for an application, you determine what degree of authentication is performed when clients call into the application. Higher authentication levels provide greater security and integrity. The authentication level that you select takes effect the next time that the application is started.

Select the appropriate authentication level. The following authentication levels are in order from lowest to highest:

  • None: No authentication occurs.

  • Connect: Authenticates credentials only when the connection is made.

  • Call: Authenticates credentials at the beginning of every call.

  • Packet: Authenticates credentials and verifies that all call data is received. This is the default setting for COM+ server applications.

  • Packet Integrity: Authenticates credentials and verifies that no call data has been modified in transit.

  • Packet Privacy: Authenticates credentials and encrypts the packet, including the data and the sender's identity and signature.

Impersonation Level

When you set an impersonation level for an application, you determine what degree of authority that the application grants other applications to use its identity when it calls them. You can set this impersonation level only for COM+ server applications. Library applications run under the identity of the hosting process, and they use the impersonation level that it specifies.

Select the appropriate impersonation level. The following impersonation levels are in order from least authority granted to greatest authority granted:

  • Anonymous: The client is anonymous to the server. The server can impersonate the client, but the impersonation token (a local credential) does not contain any information about the client.

  • Identify: The server can obtain the client's identity, and it can impersonate the client to determine access-checking levels.

  • Impersonate: This is the default setting for the COM+ server applications. The server can impersonate the client while acting on its behalf, although with restrictions. The server can access resources on the same computer as the client. If the server is on the same computer as the client, it can access network resources as the client. If the server is on a computer that is different from the client, it can access only resources that are on the same computer as the server.

  • Delegate: The server can impersonate the client while acting on its behalf, whether or not on the server is on the same computer as the client. During impersonation, the client's credentials (both the credentials with local validity and the credentials with network validity) can be passed to any number of computers.


DCOM Config <Application> Properties Sheet: Endpoints Tab

Item Details

DCOM Protocols and endpoints

In DCOM Protocols and endpoints, click the entry to specify the network protocol that is used to communicate with a remote commit coordinator:

  • Click Add to select the DCOM network protocol sequence that you want to add.

  • Click Remove to remove the highlighted entry.

  • Click Properties to change the DCOM endpoint properties for the specified protocol.

  • Click Clear to clear the list of DCOM protocols and endpoints.


DCOM Config <Application> Properties Sheet: General Tab

Item Details

Application Name

The name of the DCOM application.

Application ID

This unique application ID is generated automatically when an application is created. You can use it to identify particular versions of the application on a computer.

Application Type

The type of application, including whether the application is on the local computer or on another computer in the network.

Authentication Level

In the drop-down box, select the packet-level security that this application uses for communication. The following security settings are in order from lowest security to highest security:

  • None: No authentication occurs.

  • Connect: Authenticates credentials only when the connection is made.

  • Call: Authenticates credentials at the beginning of every call.

  • Packet: Authenticates credentials and verifies that all call data is received. This is the default setting for COM+ server applications.

  • Packet Integrity: Authenticates credentials and verifies that no call data has been modified in transit.

  • Packet Privacy: Authenticates credentials and encrypts the packet, including the data and the sender's identity and signature.

Local Path or Service Name

If Application Type is Local Server, Local Path indicates the full path to the application. If Application Type is Local Service, Service Name appears.


DCOM Config <Application> Properties Sheet: Identity Tab

Item | Details
The interactive user option button | Click to specify that the application runs under the identity of the user who is currently logged on to the computer. This user's security credentials are used when the application is authenticated to access resources.
The launching user option button | Click to specify that the application runs using the security context of the user who started the application (the launching user) so that the application can be authenticated in the domain. The launching user may be the same as the interactive user.
This user option button | Click to specify that the application runs using the security context of the specified user account so that it can be authenticated in the domain. Type the user name and password.
The system account option button | Click to specify that the server application runs using the security context of the built-in System account. This option is available only for applications that are installed as a service.


DCOM Config <Application> Properties Sheet: Location Tab

Item | Details
Run application on the computer where the data is located check box | Select this check box to specify that the application runs on the computer where the data is located. This is useful only if the client application provides a data file for the server application.
Run application on this computer check box | Select this check box to specify that the application runs on the local computer.
Run application on the following computer check box | Select this check box to specify that the application runs on the computer that you specify.


DCOM Config <Application> Properties Sheet: Security Tab

Item Details

Launch and Activation Permissions

Click one of the following option buttons:

  • Use Default: Click this button to specify that the application uses the default permissions, as set on the COM Security tab of the properties page for the computer.

  • Customize: Click this button to specify that the application uses the permissions that you set. To change the permissions, click Edit.

Access Permissions

Click one of the following option buttons:

  • Use Default: Click this button to specify that the application uses the default permissions, as set on the COM Security tab of the properties page for the computer.

  • Customize: Click this button to specify that the application uses the permissions that you set. To change the permissions, click Edit.

Configuration Permissions

Click one of the following option buttons:

  • Use Default: Click this button to specify that the application uses the default registry configuration permissions.

  • Customize: Click this button to specify that the application uses the registry configuration permissions that you set. To change the permissions, click Edit.


My Computer Properties Sheet: COM Security Tab

Items Details

Access Permissions

Click the Edit Limits button to set access permission limits on applications that determine their own permissions.

Click the Edit Default button to select user accounts and groups that are assigned or denied permissions, by default, to access applications on this computer. This setting does not affect COM+ applications.

Launch and Activation Permissions

Click the Edit Limits button to set an absolute limit on component launch and activation permissions.

Click the Edit Default button to select user accounts and groups that are assigned or denied permissions, by default, to start applications on this computer. This setting does not affect COM+ applications.


My Computer Properties Sheet: Default Properties Tab

Item Details

Enable Distributed COM on this computer check box

Select this check box to specify that DCOM is available for all Component Object Model (COM) applications that are installed on this computer, which makes it possible for this computer to exchange calls with applications on other computers.

Enable COM Internet Services on this computer check box

Select this check box to specify that DCOM communication is available over the Internet for all COM applications that are installed on this computer. This enables DCOM servers on this computer to receive inbound calls from clients that use Tunneling TCP.

Default Distributed COM Communication Properties

Default Authentication Level: Select a system-wide authentication level that COM client and server applications use to verify each other's identities during calls. Levels are listed in order of increasing security.

Default Impersonation Level: Select the system-wide default level of authority that a COM client on this computer can grant to a server application to perform processing tasks on its behalf. Levels are listed in order of increasing authority.

Provide additional security for reference tracking: Select this check box to enable authentication of distributed reference count calls on this computer. When this option is enabled, reference tracking prevents COM clients from releasing objects too early, but it can also decrease performance.


My Computer Properties Sheet: Default Protocols Tab

Item | Details
DCOM Protocols | Lists the set of network protocols that are available to DCOM on this computer. Use this dialog box to add or remove network protocols, change the priority in which they are used, and configure protocol properties.
Add | Click this button to add a network protocol that you want to be available for use by DCOM on this computer.
Remove | Click this button to remove the selected network protocol from the list of protocols that are available to DCOM on this computer.
Move Up, Move Down | Click this button to move the selected network protocol to a higher or lower priority position in the list. The ordering of the protocols reflects the priority in which they are used, with the top protocol having first priority.
Properties | Click this button to configure the properties for the selected protocol. This option might not be available for all protocols.


My Computer Properties Sheet: General Tab

Item | Details
Description | Type a description, up to 500 characters long, to help identify and manage the selected item.


My Computer Properties Sheet: MSDTC Tab

Control Details

Default Coordinator

Use local coordinator: Select this check box to designate the local system as the default coordinator.

Remote coordinator host name: If you clear the Use local coordinator check box, type the name of the computer that will serve as the remote host. To display a list of computers on the network and select one of them, click Select.


My Computer Properties Sheet: Options Tab

Item | Details
Transaction Timeout | You can enter the maximum time (in seconds) that transactions can remain active before they time out. Transactions that remain active beyond the transaction time-out period are aborted by the system automatically. If Transaction timeout is set to 0, transactions never time out.
Export | In Application Proxy RSN, type the remote server name that is used for application proxies that are exported from this server. If this box is blank, the computer network name is used.
Enable partitions check box | Select the Enable partitions check box to enable COM+ partitions on this computer. Select the Check local store when choosing partition for user check box to check the local store for COM+ partitions before checking Active Directory Domain Services (AD DS).


Local DTC Properties Sheet: Logging Tab

Item Details

Log Information

Location: To change the location of the log file, type the full path, or click Browse to select the location. Before you change the location of the log file, stop the Distributed Transaction Coordinator service in the Services snap-in. Then, restart the service after you configure logging.

Capacity: Type the size (in megabytes (MB)) of the Distributed Transaction Coordinator (DTC) log file. Before you change the size of the log file, stop the Distributed Transaction Coordinator service in the Services snap-in. Then, restart the service after you configure logging.


Local DTC Properties Sheet: Security Tab

Item Details

Security Settings — Network DTC Access check box

Select this check box if you want to allow any network traffic for the Distributed Transaction Coordinator (DTC).

If this check box is not selected, the DTC will not flow any transactions to the network, and it will not accept any incoming traffic. Remote administration of this DTC will also be disabled.

Security Settings — Client and Administration check box

Allow Remote Clients: Select this check box if you want this DTC to coordinate transactions for remote clients.

Allow Remote Administration: Select this check box if you want to allow administration of this DTC from remote computers.

Security Settings — Transaction Manager Communication

Allow Inbound: Select this check box to allow a remote computer to flow transactions to the local computer. Typically, this option is needed on the computer that is hosting the DTC for a resource manager such as Microsoft SQL Server.

Allow Outbound: Select this check box to allow the local computer to flow transactions to a remote computer. Typically, this option is needed on the client computer, where the transaction is initiated.

Mutual Authentication Required: If this option is selected, the local DTC (proxy or service) communicates with a remote DTC service using only encrypted messages and mutual authentication (Windows Domain authentication). If a secure communication cannot be established with the remote system, the communication is denied. This option can be used only for communication with computers running Windows Server 2003, Windows XP SP2, Windows Vista, or Windows Server® 2008.

Incoming Caller Authentication Required: If this option is selected, if mutual authentication cannot be established but the incoming caller can be authenticated, the communication is allowed. This option can be used only for communication with computers running Windows Server 2003 or Windows XP SP2.

No Authentication Required: If this option is selected, the DTC communication on the network can fall back to a nonauthenticated and nonencrypted communication if the attempts to start a secure communication fail. This option is used primarily to allow the DTC to communicate with computers running Windows 2000, Windows XP SP1, and earlier versions. This setting can also be used if one of the systems has turned off remote procedure call (RPC) security.

Security Settings — Enable XA Transactions check box

Select this check box to allow transactions that use the XA standard. Resource managers that run on different operating systems can communicate with a DTC transaction manager by using the XA standard.

XA interfaces are a standard set of programming interfaces that allow COM+ application developers to access XA-compliant databases and create resource managers that operate with relational databases, message queuing, transactional files, and object-oriented databases. Although Microsoft does not directly support the XA protocol, Microsoft does support translation facilities between OLE Transactions and XA.

DTC Logon Account

Specify which account the DTC service runs under.

By default, DTC runs under the Network Service account. This account is specifically designed to allow services such as the Distributed Transaction Coordinator service to run with the appropriate set of privileges. To minimize potential security problems, we recommend that you use the default Network Service account.

If you choose to change the default DTC logon account, type the name of another account in Account, or click Browse. Then, type and confirm a password.


Local DTC Properties Sheet: Tracing Tab

Item Details

Output Options

  • Trace Output, Trace Transactions: Select both of these check boxes to enable tracing.

  • Trace All Transactions: Select this check box to trace all transactions. Enabling this option can affect system performance. By default, this option is not enabled.

  • Trace Aborted Transactions: Select this check box to trace only aborted transactions. This option is selected by default.

  • Trace Long-Lived Transactions: If you select this check box, transactions that live beyond a certain time interval are traced, indicating that these transactions might not be resolved. The system-defined time-out interval is one minute plus the time-out period for the transaction (if a time-out period is specified).

Logging Options

  • New Session: Click this button to start a new logging session. Any logging session that is currently running must be stopped before a new logging session can be created. When a new logging session starts up, the DTC backs up the existing log file, if one exists.

  • Stop Session: Click this button to stop the current logging session. Stopping a trace session causes the trace log file to become unlocked so that you can delete the file, if necessary. To ensure that any data in the memory buffers is written to the log, click Flush Data before you stop a logging session.

  • Flush Data: Click this button to move all the data from its memory buffers to the log file on disk. Click this button before you view trace data to ensure that all trace data in memory is sent to disk. Otherwise, some trace data might not appear in the log file when you view it. Clicking this button might affect system performance. When the tracing session is stopped, this button is disabled.

  • Max. Num. of Memory Buffers: Change this value if you want to change the maximum number of memory buffers allowed. The default maximum value is 25. If you increase this limit, the DTC writes a message to the event viewer. This memory is taken out of the nonpageable buffer. Therefore, if the amount of memory that is available in the nonpageable buffer is not sufficient, you might not be able to set a high number for this value. In this case, the DTC displays a warning message. If this happens, click OK.


Command-line syntax notation

The following table describes the notation used to indicate command-line syntax.

Notation | Description
Text without brackets or braces | Items you must type as shown
<Text inside angle brackets> | Placeholder for which you must supply a value
[Text inside square brackets] | Optional items
{Text inside braces} | Set of required items; choose one
Vertical bar (|) | Separator for mutually exclusive items; choose one
Ellipsis (…) | Items that can be repeated