Domino on Linux/Unix, Troubleshooting, Best Practices, Tips and more ...

alt

Daniel Nashed

Domino 14.0 on Windows important to read before updating!

Daniel Nashed – 11 December 2023 14:05:59

Domino 14.0 shipped last week and I wanted to keep technical details for my DNUG Deep Dive presentation later this week.
However the first customers contacted me with problems installing Domino 14.0 GA on Windows. There is one important change you should be aware of.

The change is documented here -->
https://help.hcltechsw.com/domino/14.0.0/admin/enabling_domino_nonadmin_user.html
But not everyone might read the latest documentation before installing.

If you keep the defaults, you will need to adjust your file-system permissions for translog and other external directories not located below the data directory. Else your server will not start!


Enable running Domino as a non-admin user


As part of the "ongoing work to continuously improve security for Domino", HCL has updated the Windows installer to install to run as a non-admin user by default.


The default user is "NT Authority\LocalService" but you have the option of changing this setting to any valid Windows user.


This can be still an admin user if you really need to. Or you can change the service back to the System Account if really really needed.

But it is really a recommended best practices to use a none administrative user like the LocalService account.



LocalService


The LocalService account is a predefined local account used by the service control manager.

It has minimum privileges on the local computer and presents anonymous credentials on the network.

So it is the perfect account for running a Domino server.


The build-in account can be used without a password and the account is present on any machine.

A service can be configured automatically by InstallAnywhere without the need to specify a password.


You cannot log into the account directly. But you can switch to it for testing.

Note: In contrast to those predefined account, you would need to specify the password once in the Windows service setting before starting the service for the first time.



Update file access settings for translog and other external directories is required when running a none admin user


Previously Domino was always running using an administrative account with full permissions to all data.

The installer only takes care of updating the binary directory permissions and the data directory permissions.


Without changing the permissions of other directories -- specially important the translog directory, your server will crash like this:


[0BA4:0002-13D8] HCL Domino (r) Server (64 Bit), Release 14.0, November 09, 2023
[0BA4:0002-13D8] (C) Copyright HCL Technologies. 1987, 2023

[0BA4:0002-13D8] comp = 11, fnc = 81, probeid = 79, errcode = 5010, extsympt = 006569200000
Unexpected internal error returned to logger: 0x20692010



How to change the permissions


The documentation page shows how to use the file explorer to set the permissions.

You should note that the pre-defined accounts are translated and you might need to enter the name in your localized version to find it in the UI.


But there is also an internal presentation of accounts which works well for command-line operations.


You can also use a command-line tool to add your Local Service account to the permissions.
And you might also want to remove other access permissions.


Here are example command-lines to add the full access rights including inheritance.

To change the owner of the files and also how to remove an entry for "Everyone" from the files.


The command-lines are just examples. Adopt those to the path and users you need.
S-1-5-19
is the internal representation of the Local Service Account which works in any Windows localization.



icacls "e:\translog" /grant *S-1-5-19:(OI)(CI)(F)
icacls "e:\translog" /setowner *S-1-5-19 /t /c /q

icacls "e:\translog" /remove:g Everyone /t /c /q



Tip: Run an interactive session to check permissions
(sysinternals tool)


To validate the access rights, you could switch to the Local Service account and try to access the directories.


psexec -i -u "nt authority\localservice" cmd.exe  


Silent Install


For silent installs you also have to specify the user. There is a new setting, which needs some care.
The back slash of the user name needs to be escaped like path names. And if you prefer to keep running with the system account, the name needs to be specified in a certain way based on my testing today.

You find this new parameter along with examples how to automatically add Nomad Server and OnTime during install, in the updated installer properties file inside the extracted webkit.


For Local Service account specify



IA_USERNAME=NT AUTHORITY\\LocalService


For the system account specify


IA_USERNAME=LocalSystem



Check additional dependencies


Some add-on applications might not work with a normal account. You should check all your applications when planning an update.

If really needed you can always switch back to the old mode to not delay your updates.

But it would make a lot of sense to use the new standard which aligns Domino on Windows with Linux and AIX.

Links

    Archives


    • [HCL Domino]
    • [Domino on Linux]
    • [Nash!Com]
    • [Daniel Nashed]