如何在Windows 10通过命令行将指定DCOM本地安全策略设为未定义

Hey there! Let's walk through how to set those two DCOM security settings to Not Defined using the command line on Windows 10. These settings map directly to registry keys, so we'll use the reg command to modify them.

Prerequisite #

First, make sure you open your command line (Command Prompt or PowerShell) as an administrator—you won't have permission to modify these registry keys otherwise. Right-click the Start menu and select either "Windows PowerShell (Admin)" or "Command Prompt (Admin)".

Step 1: Backup the Registry Key (Optional but Highly Recommended) #

Before making changes, it's smart to back up the relevant registry key in case you need to revert later. Run this command to save a backup to your C: drive (you can adjust the path if needed):

reg export "HKLM\SOFTWARE\Microsoft\Ole" "C:\OleRegistryBackup.reg"

Step 2: Set "DCOM:Machine Launch Restrictions in SDDL syntax" to Not Defined #

This setting is controlled by the MachineLaunchRestriction value under the HKLM\SOFTWARE\Microsoft\Ole key. To set it to Not Defined, we delete this value entirely:

reg delete "HKLM\SOFTWARE\Microsoft\Ole" /v MachineLaunchRestriction /f

The /f flag forces deletion without prompting for confirmation.

Step 3: Set "DCOM:Machine Access Restrictions in SDDL syntax" to Not Defined #

Similarly, this setting uses the MachineAccessRestriction value. Delete it with this command:

reg delete "HKLM\SOFTWARE\Microsoft\Ole" /v MachineAccessRestriction /f

Verify the Changes #

To confirm it worked, open the Local Security Policy (secpol.msc) via the Start menu. Navigate to Local Policies > Security Options, and look for the two DCOM settings—they should now show as Not Defined.

If you don't see the change immediately, a quick system restart will ensure the registry changes take full effect.

内容的提问来源于stack exchange，提问作者Aparna