Domino 14.0 on Windows important to read before updating!
Daniel Nashed – 11 December 2023 14:05:59
Domino 14.0 shipped last week and I wanted to keep technical details for my DNUG Deep Dive presentation later this week.
However the first customers contacted me with problems installing Domino 14.0 GA on Windows. There is one important change you should be aware of.
The change is documented here --> https://help.hcltechsw.com/domino/14.0.0/admin/enabling_domino_nonadmin_user.html
But not everyone might read the latest documentation before installing.
If you keep the defaults, you will need to adjust your file-system permissions for translog and other external directories not located below the data directory. Else your server will not start!
Enable running Domino as a non-admin user
As part of the "ongoing work to continuously improve security for Domino", HCL has updated the Windows installer to install to run as a non-admin user by default.
The default user is "NT Authority\LocalService" but you have the option of changing this setting to any valid Windows user.
This can be still an admin user if you really need to. Or you can change the service back to the System Account if really really needed.
But it is really a recommended best practices to use a none administrative user like the LocalService account.
LocalService
The LocalService account is a predefined local account used by the service control manager.
It has minimum privileges on the local computer and presents anonymous credentials on the network.
So it is the perfect account for running a Domino server.
The build-in account can be used without a password and the account is present on any machine.
A service can be configured automatically by InstallAnywhere without the need to specify a password.
You cannot log into the account directly. But you can switch to it for testing.
Note: In contrast to those predefined account, you would need to specify the password once in the Windows service setting before starting the service for the first time.
Update file access settings for translog and other external directories is required when running a none admin user
Previously Domino was always running using an administrative account with full permissions to all data.
The installer only takes care of updating the binary directory permissions and the data directory permissions.
Without changing the permissions of other directories -- specially important the translog directory, your server will crash like this:
[0BA4:0002-13D8] HCL Domino (r) Server (64 Bit), Release 14.0, November 09, 2023
[0BA4:0002-13D8] (C) Copyright HCL Technologies. 1987, 2023
[0BA4:0002-13D8] comp = 11, fnc = 81, probeid = 79, errcode = 5010, extsympt = 006569200000
Unexpected internal error returned to logger: 0x20692010
How to change the permissions
The documentation page shows how to use the file explorer to set the permissions.
You should note that the pre-defined accounts are translated and you might need to enter the name in your localized version to find it in the UI.
But there is also an internal presentation of accounts which works well for command-line operations.
You can also use a command-line tool to add your Local Service account to the permissions.
And you might also want to remove other access permissions.
Here are example command-lines to add the full access rights including inheritance.
To change the owner of the files and also how to remove an entry for "Everyone" from the files.
The command-lines are just examples. Adopt those to the path and users you need.
S-1-5-19 is the internal representation of the Local Service Account which works in any Windows localization.
icacls "e:\translog" /grant *S-1-5-19:(OI)(CI)(F)
icacls "e:\translog" /setowner *S-1-5-19 /t /c /q
icacls "e:\translog" /remove:g Everyone /t /c /q
Tip: Run an interactive session to check permissions (sysinternals tool)
To validate the access rights, you could switch to the Local Service account and try to access the directories.
psexec -i -u "nt authority\localservice" cmd.exe
Silent Install
For silent installs you also have to specify the user. There is a new setting, which needs some care.
The back slash of the user name needs to be escaped like path names. And if you prefer to keep running with the system account, the name needs to be specified in a certain way based on my testing today.
You find this new parameter along with examples how to automatically add Nomad Server and OnTime during install, in the updated installer properties file inside the extracted webkit.
For Local Service account specify
IA_USERNAME=NT AUTHORITY\\LocalService
For the system account specify
IA_USERNAME=LocalSystem
Check additional dependencies
Some add-on applications might not work with a normal account. You should check all your applications when planning an update.
If really needed you can always switch back to the old mode to not delay your updates.
But it would make a lot of sense to use the new standard which aligns Domino on Windows with Linux and AIX.
- Comments [7]
1Christian Henseler 11.12.2023 16:13:04 Domino 14.0 on Windows important to read before updating!
Great article, thank you very much :-)
I think any filesystem related optimization must be checked/updated.
I think of Domino specific features like
Database/Directory link,
view_rebuild_dir
etc...
that may cause issues long after the Domino server has been started...
2Thomas Adrian 12.12.2023 9:27:20 Domino 14.0 on Windows important to read before updating!
thanks. I upgraded domino 12.0.2FP2 to Domino 14 and did not use the NT Authority, I specified an administrator account during install.
The server runs fine when starting manually but does not start when run as a service. and there is no log to be found of what can be the cause of the service not starting.
I tried to change the service logon account to Local system account but no luck
any ideas?
3Daniel Nashed 12.12.2023 10:33:20 Domino 14.0 on Windows important to read before updating!
@Christian,
yes there is much more than just the usual suspects translog, DAOS. there is the notes temp, diagnostic directory and anything else that can be a separate directory.
also junctions, directory/database links etc. But I did not want to make this a big and complex posting.
This is more to raise the awareness what changed, what in general is the problem and how to deal with it.
But of couse there are many different edge cases that you can run into with this change.
There is also a known issue that NT Event integration reports errors. but this is a small side problem compared to translog crashing on startup and admins looking for what is wrong with their translog after update.
Admins might question their translog and recreate it for no need if not knowing about the problem ..
4Thomas Adrian 12.12.2023 11:57:21 Domino 14.0 on Windows important to read before updating!
In reply to my problem ”running domino as a service above” , it was not Domino 14 related. I had incorrect mapping of ip address to the console controller.
5Stephen Bailey 22.02.2024 10:57:45 Domino 14.0 on Windows important to read before updating!
Hi Daniel,
Just to say thanks for this blog post. I've just run the shared commands on a new Domino 14 server to allow one of our apps to write files to a share on the hosting system, and it worked first time!
Great job!
SB
6Friedhelm Klein 03.04.2024 7:04:31 Domino 14.0 on Windows important to read before updating!
Hi Daniel,
the icacls commands you have listed change the access rights they way Domino 14 requires them, but it does not remove the inherited rights that were previously assigned.
To achieve this add
icacls "e:\translog" /inheritance:r
If not, the newly set and existing access rights are assigned in parallel.
With removed inheritance, the acl looks identical to <data>.
Of couse you have to repeat the steps for DaosBasePath
FTBasePath and
NIFBasePath
View_rebuild_dir,
Notes_TempDir,
and all other directories that might be accessed by agents, e.g. import/export directories.
Regards
Friedhelm
7Dominique 24.05.2024 8:14:13 Domino 14.0 on Windows important to read before updating!
Thank you.