OPC Classic client least privilege configuration

 The OPC Classic server is running on a different machine and is running a specific account, say opcuser.  The OPC Classic client is running as another user, say u1. My goal is to configure my client machine as secure as possible using subscription/callback, thus say:

• Windows Firewall is enabled

• UAC is enabled

• OPC Classic client is subscribing (instead of polling the server) using DCOM callback

Do the following on the client machine

Step 1. Allow DCOM inbound in Windows Firewall. Run on elevated command prompt

netsh advfirewall firewall add rule name="RPC Endpoint Mapper" dir=in action=allow protocol=TCP localport=135

Step 2. Add opcuser to Distributed COM Users

net localgroup "Distributed COM Users" /add opcuser

Step 3. Run Component Services (dcomcnfg.exe) and Distributed COM Users to Default Access Permissions

1. Navigate to console Root | Component Services | Computers | My Computer

2. Bring "My Computer" Properties

3. Navigate to COM Security tab

4. Click on Access Permissions | Edit Default...

5. In Access Permission, add Distributed COM Users and check allow for both Local Access and Remote Access

Step 4. Add Windows Firewall rule for the application. Below assumes the application is located in C:\opc directory. 

netsh advfirewall firewall add rule name="OPC Client Inbound" dir=in action=allow program="C:\opc\oclientnet.exe" enable=yes

REF: 20250907-least

DCOM callback not working with UAC enabled

 OPC Classic DCOM client not receiving callback when UAC is enabled

The OPC Classic server is running on another node and is running using a specific user, say opcuser. The OPC Classic client is also running as a different user, say user1. The opcuser on the client is a member of the Administrators group but UAC is enabled. The issue is that the client is not receiving a callback due to UAC restrictions. When an account is accessed remotely, UAC gives it a "filtered" token without full administrative rights. This is a common cause of DCOM callback failures in workgroup environments.

To fix this, on the OPC client machine (the one receiving the callback), you need to modify the registry:

1. Open the Registry Editor (regedit).

2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System.

3. Create a new DWORD (32-bit) Value named LocalAccountTokenFilterPolicy.

4. Set its value to 1.

5. Reboot the machine.

This change tells Windows to not filter the administrative token for local accounts over the network, allowing DCOM callbacks to function correctly without disabling the core security benefits of UAC.

REF: 20250907