Tales from friends:
Apparently, disabling DCOM by revoking privileges across an entire AD domain is a bad idea.
Also, don't revoke DCOM privileges from NT Authority\SYSTEM if you want your box to boot.
How you do this is still a mystery.
The social network of the future: No ads, no corporate surveillance, ethical design, and decentralization! Own your data with Mastodon!