Cannot launch COM objects with IUSR_computername or IWAM_computername accounts

Applies To: Windows Server 2003 R2, Windows Server 2003 with SP1

For Windows Server 2003, the IUSR_computername and IWAM_computername accounts are created and granted launch permissions to DCOM components by default when installing IIS. For Windows Server 2003 Service Pack 1 (SP1), the accounts are still created, but are no longer granted launch permissions to DCOM components by default when installing IIS.

If you had installed IIS prior to upgrading to SP1, the permissions will not be changed. However, if you install IIS after upgrading to SP1, Component Object Model (COM) objects will fail to launch under the IUSR_computername and IWAM_computername accounts if your application uses default launch permissions for those accounts. In this situation you will receive an "Access denied" error message, because COM+ is passing credentials that are not valid to Windows Server 2003. To remedy this problem, grant explicit launch permissions to specific user(s) or group(s) to launch COM objects instead of using default launch permissions. You should also ensure that IIS, COM+, and Windows all have the same password for the IWAM_computername account. For more information about configuring launch permissions, see Configuring Launch Permissions for COM+ Server Objects.