Tales from friends:
Apparently, disabling DCOM by revoking privileges across an entire AD domain is a bad idea.
Also, don't revoke DCOM privileges from NT Authority\SYSTEM if you want your box to boot.
How you do this is still a mystery.
Currently a closed instance for FriskyPaws.net staff and guests.