Domino on Linux/Unix, Troubleshooting, Best Practices, Tips and more ...

alt

Daniel Nashed

Domino 14.0 on Windows important to read before updating!

Daniel Nashed – 11 December 2023 14:05:59

Domino 14.0 shipped last week and I wanted to keep technical details for my DNUG Deep Dive presentation later this week.
However the first customers contacted me with problems installing Domino 14.0 GA on Windows. There is one important change you should be aware of.

The change is documented here -->
https://help.hcltechsw.com/domino/14.0.0/admin/enabling_domino_nonadmin_user.html
But not everyone might read the latest documentation before installing.

If you keep the defaults, you will need to adjust your file-system permissions for translog and other external directories not located below the data directory. Else your server will not start!


Enable running Domino as a non-admin user


As part of the "ongoing work to continuously improve security for Domino", HCL has updated the Windows installer to install to run as a non-admin user by default.


The default user is "NT Authority\LocalService" but you have the option of changing this setting to any valid Windows user.


This can be still an admin user if you really need to. Or you can change the service back to the System Account if really really needed.

But it is really a recommended best practices to use a none administrative user like the LocalService account.



LocalService


The LocalService account is a predefined local account used by the service control manager.

It has minimum privileges on the local computer and presents anonymous credentials on the network.

So it is the perfect account for running a Domino server.


The build-in account can be used without a password and the account is present on any machine.

A service can be configured automatically by InstallAnywhere without the need to specify a password.


You cannot log into the account directly. But you can switch to it for testing.

Note: In contrast to those predefined account, you would need to specify the password once in the Windows service setting before starting the service for the first time.



Update file access settings for translog and other external directories is required when running a none admin user


Previously Domino was always running using an administrative account with full permissions to all data.

The installer only takes care of updating the binary directory permissions and the data directory permissions.


Without changing the permissions of other directories -- specially important the translog directory, your server will crash like this:


[0BA4:0002-13D8] HCL Domino (r) Server (64 Bit), Release 14.0, November 09, 2023
[0BA4:0002-13D8] (C) Copyright HCL Technologies. 1987, 2023

[0BA4:0002-13D8] comp = 11, fnc = 81, probeid = 79, errcode = 5010, extsympt = 006569200000
Unexpected internal error returned to logger: 0x20692010



How to change the permissions


The documentation page shows how to use the file explorer to set the permissions.

You should note that the pre-defined accounts are translated and you might need to enter the name in your localized version to find it in the UI.


But there is also an internal presentation of accounts which works well for command-line operations.


You can also use a command-line tool to add your Local Service account to the permissions.
And you might also want to remove other access permissions.


Here are example command-lines to add the full access rights including inheritance.

To change the owner of the files and also how to remove an entry for "Everyone" from the files.


The command-lines are just examples. Adopt those to the path and users you need.
S-1-5-19
is the internal representation of the Local Service Account which works in any Windows localization.



icacls "e:\translog" /grant *S-1-5-19:(OI)(CI)(F)
icacls "e:\translog" /setowner *S-1-5-19 /t /c /q

icacls "e:\translog" /remove:g Everyone /t /c /q



Tip: Run an interactive session to check permissions
(sysinternals tool)


To validate the access rights, you could switch to the Local Service account and try to access the directories.


psexec -i -u "nt authority\localservice" cmd.exe  


Silent Install


For silent installs you also have to specify the user. There is a new setting, which needs some care.
The back slash of the user name needs to be escaped like path names. And if you prefer to keep running with the system account, the name needs to be specified in a certain way based on my testing today.

You find this new parameter along with examples how to automatically add Nomad Server and OnTime during install, in the updated installer properties file inside the extracted webkit.


For Local Service account specify



IA_USERNAME=NT AUTHORITY\\LocalService


For the system account specify


IA_USERNAME=LocalSystem



Check additional dependencies


Some add-on applications might not work with a normal account. You should check all your applications when planning an update.

If really needed you can always switch back to the old mode to not delay your updates.

But it would make a lot of sense to use the new standard which aligns Domino on Windows with Linux and AIX.

Comments

1Christian Henseler  11.12.2023 16:13:04  Domino 14.0 on Windows important to read before updating!

Great article, thank you very much :-)

I think any filesystem related optimization must be checked/updated.

I think of Domino specific features like

Database/Directory link,

view_rebuild_dir

etc...

that may cause issues long after the Domino server has been started...

2Thomas Adrian  12.12.2023 9:27:20  Domino 14.0 on Windows important to read before updating!

thanks. I upgraded domino 12.0.2FP2 to Domino 14 and did not use the NT Authority, I specified an administrator account during install.

The server runs fine when starting manually but does not start when run as a service. and there is no log to be found of what can be the cause of the service not starting.

I tried to change the service logon account to Local system account but no luck

any ideas?

3Daniel Nashed  12.12.2023 10:33:20  Domino 14.0 on Windows important to read before updating!

@Christian,

yes there is much more than just the usual suspects translog, DAOS. there is the notes temp, diagnostic directory and anything else that can be a separate directory.

also junctions, directory/database links etc. But I did not want to make this a big and complex posting.

This is more to raise the awareness what changed, what in general is the problem and how to deal with it.

But of couse there are many different edge cases that you can run into with this change.

There is also a known issue that NT Event integration reports errors. but this is a small side problem compared to translog crashing on startup and admins looking for what is wrong with their translog after update.

Admins might question their translog and recreate it for no need if not knowing about the problem ..

4Thomas Adrian  12.12.2023 11:57:21  Domino 14.0 on Windows important to read before updating!

In reply to my problem ”running domino as a service above” , it was not Domino 14 related. I had incorrect mapping of ip address to the console controller.

5Stephen Bailey  22.02.2024 10:57:45  Domino 14.0 on Windows important to read before updating!

Hi Daniel,

Just to say thanks for this blog post. I've just run the shared commands on a new Domino 14 server to allow one of our apps to write files to a share on the hosting system, and it worked first time!

Great job!

SB

6Friedhelm Klein  03.04.2024 7:04:31  Domino 14.0 on Windows important to read before updating!

Hi Daniel,

the icacls commands you have listed change the access rights they way Domino 14 requires them, but it does not remove the inherited rights that were previously assigned.

To achieve this add

icacls "e:\translog" /inheritance:r

If not, the newly set and existing access rights are assigned in parallel.

With removed inheritance, the acl looks identical to <data>.

Of couse you have to repeat the steps for DaosBasePath

FTBasePath and

NIFBasePath

View_rebuild_dir,

Notes_TempDir,

and all other directories that might be accessed by agents, e.g. import/export directories.

Regards

Friedhelm

7Dominique  24.05.2024 8:14:13  Domino 14.0 on Windows important to read before updating!

Thank you.

Links

    Archives


    • [HCL Domino]
    • [Domino on Linux]
    • [Nash!Com]
    • [Daniel Nashed]