Domino 14.0 on Windows important to read before updating!
Daniel Nashed 11 December 2023 14:05:59
Domino 14.0 shipped last week and I wanted to keep technical details for my DNUG Deep Dive presentation later this week.
However the first customers contacted me with problems installing Domino 14.0 GA on Windows. There is one important change you should be aware of.
The change is documented here --> https://help.hcltechsw.com/domino/14.0.0/admin/enabling_domino_nonadmin_user.html
But not everyone might read the latest documentation before installing.
If you keep the defaults, you will need to adjust your file-system permissions for translog and other external directories not located below the data directory. Else your server will not start!
Enable running Domino as a non-admin user
As part of the "ongoing work to continuously improve security for Domino", HCL has updated the Windows installer to install to run as a non-admin user by default.
The default user is "NT Authority\LocalService" but you have the option of changing this setting to any valid Windows user.
This can be still an admin user if you really need to. Or you can change the service back to the System Account if really really needed.
But it is really a recommended best practices to use a none administrative user like the LocalService account.
LocalService
The LocalService account is a predefined local account used by the service control manager.
It has minimum privileges on the local computer and presents anonymous credentials on the network.
So it is the perfect account for running a Domino server.
The build-in account can be used without a password and the account is present on any machine.
A service can be configured automatically by InstallAnywhere without the need to specify a password.
You cannot log into the account directly. But you can switch to it for testing.
Note: In contrast to those predefined account, you would need to specify the password once in the Windows service setting before starting the service for the first time.
Update file access settings for translog and other external directories is required when running a none admin user
Previously Domino was always running using an administrative account with full permissions to all data.
The installer only takes care of updating the binary directory permissions and the data directory permissions.
Without changing the permissions of other directories -- specially important the translog directory, your server will crash like this:
[0BA4:0002-13D8] HCL Domino (r) Server (64 Bit), Release 14.0, November 09, 2023
[0BA4:0002-13D8] (C) Copyright HCL Technologies. 1987, 2023
[0BA4:0002-13D8] comp = 11, fnc = 81, probeid = 79, errcode = 5010, extsympt = 006569200000
Unexpected internal error returned to logger: 0x20692010
How to change the permissions
The documentation page shows how to use the file explorer to set the permissions.
You should note that the pre-defined accounts are translated and you might need to enter the name in your localized version to find it in the UI.
But there is also an internal presentation of accounts which works well for command-line operations.
You can also use a command-line tool to add your Local Service account to the permissions.
And you might also want to remove other access permissions.
Here are example command-lines to add the full access rights including inheritance.
To change the owner of the files and also how to remove an entry for "Everyone" from the files.
The command-lines are just examples. Adopt those to the path and users you need.
S-1-5-19 is the internal representation of the Local Service Account which works in any Windows localization.
icacls "e:\translog" /grant *S-1-5-19:(OI)(CI)(F)
icacls "e:\translog" /setowner *S-1-5-19 /t /c /q
icacls "e:\translog" /remove:g Everyone /t /c /q
Tip: Run an interactive session to check permissions (sysinternals tool)
To validate the access rights, you could switch to the Local Service account and try to access the directories.
psexec -i -u "nt authority\localservice" cmd.exe
Silent Install
For silent installs you also have to specify the user. There is a new setting, which needs some care.
The back slash of the user name needs to be escaped like path names. And if you prefer to keep running with the system account, the name needs to be specified in a certain way based on my testing today.
You find this new parameter along with examples how to automatically add Nomad Server and OnTime during install, in the updated installer properties file inside the extracted webkit.
For Local Service account specify
IA_USERNAME=NT AUTHORITY\\LocalService
For the system account specify
IA_USERNAME=LocalSystem
Check additional dependencies
Some add-on applications might not work with a normal account. You should check all your applications when planning an update.
If really needed you can always switch back to the old mode to not delay your updates.
But it would make a lot of sense to use the new standard which aligns Domino on Windows with Linux and AIX.
- Comments [6]
![[HCL Domino]](../lotus-domino.gif){kind=small}
![[Domino on Linux]](../domino-linux.gif){kind=small}
![[Nash!Com]](../nashcom.gif){kind=small}
![[Daniel Nashed]](../daniel-nsh.gif){kind=small}