RPCDCOM

RPCDCOM refers to the integration of Remote Procedure Call (RPC) and Distributed Component Object Model (DCOM) technologies in Microsoft Windows, enabling clients to create and invoke methods on COM objects that reside on remote machines or in different processes. It combines RPC’s transport and marshalling capabilities with DCOM’s distributed object model to support inter-process communication across network boundaries.

Architecture and operation: The RPC runtime provides the underlying communication channel, while DCOM handles distributed object activation, lifetime management, and remote proxies. Core components include the RPC endpoint mapper, which helps locate service endpoints, the DCOM server process launcher (Dllhost) that hosts server objects, and the proxy/stub infrastructure generated for COM interfaces. Clients access remote COM objects using identifiers such as CLSIDs or ProgIDs. Calls are marshaled across the network, processed by the remote server, and results are marshaled back to the client.

Security and configuration: COM security settings govern authentication, authorization, and data integrity for RPC/DCOM calls. Authentication typically uses Kerberos or NTLM, with authorization controlled by Access Control Lists and COM security configuration (for example, through CoInitializeSecurity). Due to the networked nature of RPCDCOM, proper firewall configuration is important: RPC communications commonly start with an endpoint mapper on port 135 and proceed over dynamic high ports. Restricting exposure to trusted networks and applying the principle of least privilege are recommended to mitigate risks.

See also: Remote Procedure Call (RPC), Distributed Component Object Model (DCOM), Windows RPC, Dllhost, COM security.