While testing the custom SSP for DCOM authentication, I remembered it is necessary to call CoSetProxyBlanket after the client has called CoCreateInstanceEx, because the SSP requested in CoCreateInstanceEx only applies to the acquisition of the interface and not to calls on the interface. What I didnt remember was that it is also necessary to call CoSetProxyBlanket on the controlling IUnknown interface of the proxy. So I was initially puzzled when I saw, in the debug window, an exception being thrown when my interface smart pointer went out of scope, and the COM local server continued running even though I assumed all references to it had been released.
The solution is to QI for the IUnknown interface on the proxy and call CoSetProxyBlanket on this at some point before releasing it and the other interfaces that have been acquired on the object. Of course if you don't do this the object is eventually released via the COM pinging mechanism but that can take up to six minutes which night cause problems in some circumstances