title: Is allowing unauthenticated RPC calls okay for servers behind a corporate firewall?
body: <p>Our distributes application uses Microsoft RPC for interprocess communications. Starting with Windows XP SP2 and Windows 2003 SP1 Microsoft <a href="http://technet.microsoft.com/en-us/library/cc781010(WS.10).aspx" rel="nofollow noreferrer">tightened the bolts</a> so now the programs on two different computers can't communicate that easily.</p>
  
  <p>Either they both must be running under suitable user accounts so that uathentication succeeds or the RPC server must "open the hole" by calling <a href="http://msdn.microsoft.com/en-us/library/aa378440(VS.85).aspx" rel="nofollow noreferrer">RpcServerRegisterIf2()</a> with <code>RPC_IF_ALLOW_CALLBACKS_WITH_NO_AUTH</code> flag to allow unathenticated calls as prior to the "tightening" change.</p>
  
  <p>How safe is the second option? Will it really compromise the computer which is behind a corporate firewall?</p>
  
  <p>Asking this here because it's a program design problem, not setup problem.</p>