The client is not authenticated. It is not possible for the server to determine the identity of the caller. The client is authenticated when the connection is first established, and never again. The client is authenticated each time a method call is made. PacketIntegrity Each packet is authenticated, and verified to have the same content as when it was sent.
All data is encrypted across the wire.
Note that for local COM, the AuthenticationLevel appears to be PacketPrivacy , but no encryption actually occurs on the local machine. DCOM uses the RC4 encryption algorithm. Here is a quick summary of the impersonation levels available. The value set on the client machine determines the impersonation level used for the connection. The impersonation level set on the server machine is not used.