Can we see DCOM handshaking? I showed the COM plumbing, but the customer wanted to know about 'handshaking,' which I could not show with the session file.
DA doesn't currently log any "DCOM handshaking" (i.e. authentication) events. However, any failures to create/marshal a DCOM object will be reported by DA.