Grooper Infrastructure - Revision history

Dgreenwood: /* Minimum Recommendation */

2026-06-18T14:47:34Z

Minimum Recommendation

← Older revision		Revision as of 09:47, 18 June 2026
Line 115:		Line 115:
	* '''AMD:''' 2nd Gen EPYC (Rome / 7002 series, 2019) or newer with DDR4		* '''AMD:''' 2nd Gen EPYC (Rome / 7002 series, 2019) or newer with DDR4

	Servers running CPU generations older than those listed above will experience degraded performance, potential ~~combability~~ issues and are not supported.		Servers running CPU generations older than those listed above will experience degraded performance, potential compatibility issues and are not supported.

	==== Performance Recommendation (High-Throughput Environments) ====		==== Performance Recommendation (High-Throughput Environments) ====

Dgreenwood: /* Server Memory Recomendations */

2026-06-18T14:38:34Z

Server Memory Recomendations

← Older revision		Revision as of 09:38, 18 June 2026
Line 104:		Line 104:

	</div>		</div>
	=== Server Memory ~~Recomendations~~ ===		=== Server Memory and CPU Recommendations ===

	Grooper has two tiers of server memory guidance depending on your deployment environment.		Grooper has two tiers of server memory guidance depending on your deployment environment.
Line 130:		Line 130:
	*<li class="attn-bullet"> '''Note:''' DDR5 is not backward compatible with DDR4. Meeting the performance recommendation requires a compatible CPU, motherboard, and DDR5 memory — upgrading memory alone is not sufficient.		*<li class="attn-bullet"> '''Note:''' DDR5 is not backward compatible with DDR4. Meeting the performance recommendation requires a compatible CPU, motherboard, and DDR5 memory — upgrading memory alone is not sufficient.
	</div>		</div>

	=== Client Computer ===		=== Client Computer ===
	This refers to a machine connecting to a Grooper Repository by opening the Grooper web app in a browser. The client computer does ''not'' need either the main Grooper application or the Grooper Web Client application installed. It just needs to be able to connect to the Grooper Repository using a supported browser.		This refers to a machine connecting to a Grooper Repository by opening the Grooper web app in a browser. The client computer does ''not'' need either the main Grooper application or the Grooper Web Client application installed. It just needs to be able to connect to the Grooper Repository using a supported browser.

Dgreenwood: /* Client Computer */

2026-06-18T14:37:03Z

Client Computer

@@ Line 103: / Line 103: @@
 {{Template:LeastPrivilegeServiceAccounts}}
 </div>
 === Client Computer ===
@@ Line 118: / Line 144: @@
 **<li class="fyi-bullet"> ''For more information visit the [[Desktop Scanning in Grooper]] article.''
 </div>
 ===Windows Prerequisites===
 The following are included in the installation package of Grooper and are required for installation.

Dgreenwood: /* App Pool Identity Permissions */

2026-06-18T13:32:16Z

App Pool Identity Permissions

← Older revision		Revision as of 08:32, 18 June 2026
Line 85:		Line 85:
	<div style="padding-left: 1.5em;">		<div style="padding-left: 1.5em;">
	==== Grooper App Pool User ====		==== Grooper App Pool User ====

	~~== App Pool Identity Permissions ==~~

	{{Template:LeastPrivilegeAppPoolAccounts}}		{{Template:LeastPrivilegeAppPoolAccounts}}

Dgreenwood: /* App Pool Identity Permissions */

2026-06-11T15:48:29Z

App Pool Identity Permissions

@@ Line 88: / Line 88: @@
 == App Pool Identity Permissions ==
-When installing the Grooper web client, you will need to assign an application pool identity — a Windows account under which Grooper runs. This account must be granted specific permissions to launch and operate the Grooper website.
+{{Template:LeastPrivilegeAppPoolAccounts}}
 </div>
@@ Line 153: / Line 103: @@
 ==== Grooper Service Users ====
-The Activity Processing service automates task processing for Batches in Grooper. They need a minimum set of permissions in order to execute tasks.
+{{Template:LeastPrivilegeServiceAccounts}}
 </div>
 === Client Computer ===

Dgreenwood: /* Grooper App Pool User */

2026-06-11T13:48:44Z

Grooper App Pool User

← Older revision		Revision as of 08:48, 11 June 2026
Line 86:		Line 86:
	==== Grooper App Pool User ====		==== Grooper App Pool User ====

	The Grooper "application pool identity" is a Windows account that runs the Grooper application installed on a Grooper web server. This account must be given certain permissions in order to launch the Grooper website in a web browser and run Grooper from that browser.		== App Pool Identity Permissions ==

	From a security standpoint, ~~it is best practice to only give a~~ minimum ~~number of~~ permissions to ~~this account~~.		When installing the Grooper web client, you will need to assign an application pool identity — a Windows account under which Grooper runs. This account must be granted specific permissions to launch and operate the Grooper website.
	* It is unadvisable to ~~give~~ full local ~~admin~~ privileges to the Grooper ~~application~~ pool identity.
	* The ~~minimum number of permissions required are as follows:~~		From a security standpoint, this account should be granted the minimum permissions required to function. It is unadvisable to grant full local administrator privileges to the Grooper app pool identity.

			'''Note:''' The user performing the installation must also have the ability to query the domain in order to enter credentials for the app pool identity during setup.

	{\|class="wikitable"		{\|class="wikitable"
	\|-		\|-
	\|		! Permission
	~~'''~~Permission~~'''~~		! Type
	\|		! Where to Configure
	~~'''~~Type~~'''~~		! Reason
	\|
	~~'''~~Reason~~'''~~
	\|-		\|-
	\|colspan=3\|		\|colspan=4\|
	'''''Always Required'''''		'''''Always Required'''''
	\|-		\|-
	\|		\| Read Member Of
	Read Member Of		\| Active Directory
	\|		\| Active Directory Users and Computers (or via Group Policy)
	Active Directory		\| Required to check the authenticated user's group membership at login
	\|
	Required ~~for checking~~ user's group membership
	\|-		\|-
	\|		\| Local Users Group
	Users		\| Local
	\|		\| Computer Management → Local Users and Groups → Groups → Users
	Local		\| Grants rights to run installed applications, including Grooper
	\|
	~~Run the~~ installed applications (Grooper)
	\|-		\|-
	\|		\| File Store Access
	File ~~store access~~		\| NTFS / Share
	\|		\| Windows Explorer → Folder Properties → Security (NTFS) and/or Share Permissions
	NTFS\Share		\| Read and write access to the Grooper file store location
	\|
	Read and write access to the Grooper file store location
	\|-		\|-
	\|		\| Database Access
	Database ~~access~~		\| SQL Server
	\|		\| SQL Server Management Studio → Security → Logins → [account] → User Mapping → [GrooperDB]
	SQL		\| Read and write access to the Grooper database. Grant '''db_datareader''' and '''db_datawriter''' on the Grooper database.
	\|
	Read and write access to the Grooper database
	\|-		\|-
	\|colspan=3\|		\|colspan=4\|
	'''''Conditionally Required'''''		'''''Conditionally Required'''''
	\|-		\|-
	\|		\| C:\Release
	C:\Release		\| Local / NTFS
	\|		\| Windows Explorer → Folder Properties → Security
	Local\NTFS		\| Required when implementing Object Libraries or custom scripts — grants rights to run MSBuild for compilation
	\|
	~~Run MsBuild for compiling Object Libraries and custom scripts in Grooper~~
	* Required when implementing Object Libraries or ~~other scripting.~~
	\|-		\|-
	\|		\| Logon As Service
	Logon As Service		\| Local Security Policy
	\|		\| Local Security Policy → Local Policies → User Rights Assignment → Log on as a service
	Local Security Policy		\| Required only if the app pool identity is also being used as a Grooper service account
	\|
	~~Run services installed via Grooper Command Console~~
	* Required if ~~also using~~ the ~~application~~ pool identity as a service account ~~running Grooper services~~
	\|}		\|}

			'''Note:''' The permissions above cover normal application operation. Elevated database rights — such as the ability to create or alter tables — are only required during initial installation or upgrades if alterations to the Grooper database tables are required or new tables are added. Furthermore, only the user running [[Grooper Command Console]] (GCC) will need these rights.
	</div>		</div>

	=== Grooper Processing Servers ===		=== Grooper Processing Servers ===
	This refers to any machine in the Grooper "processing environment". A processing environment will be composed of the Grooper web server ''and'' any machine dedicated to hosting Grooper's Activity Processing services.		This refers to any machine in the Grooper "processing environment". A processing environment will be composed of the Grooper web server ''and'' any machine dedicated to hosting Grooper's Activity Processing services.

Dgreenwood: /* Windows Prerequisites */

2026-05-13T15:48:17Z

Windows Prerequisites

← Older revision		Revision as of 10:48, 13 May 2026
Line 232:		Line 232:
	:The Microsoft Access Database Engine is available in multiple editions, which mainly depend on which Microsoft Office product you’re using. The hint is in the year. As such, if you use Microsoft Office 2016, then you need Microsoft Access Database Engine 2016.		:The Microsoft Access Database Engine is available in multiple editions, which mainly depend on which Microsoft Office product you’re using. The hint is in the year. As such, if you use Microsoft Office 2016, then you need Microsoft Access Database Engine 2016.
	</div>		</div>

			===Identity Providers===
			Grooper supports the following identity providers:
			* Active Directory
			* Microsoft Entra ID

	== Thread processing guidance ==		== Thread processing guidance ==

Dgreenwood: /* Thread processing guidance */

2026-02-06T15:52:56Z

Thread processing guidance

← Older revision		Revision as of 10:52, 6 February 2026
Line 235:		Line 235:
	== Thread processing guidance ==		== Thread processing guidance ==

	Grooper Activity Processing services distribute processing resources to automated tasks in a Batch Process~~. These services use~~ your system's processing threads ~~to do this~~. Other Grooper services (such as Import Watcher ~~services)~~ also ~~use~~ threads to perform their work.		Grooper Activity Processing services distribute processing resources to automated tasks in a Batch Process using your system's processing threads. Other Grooper services, such as Import Watcher, also consume threads to perform their work.

	~~Please visit~~ the [[Thread Processing Guidance]] article ~~for more information. This article explains how thread processing works and outlines best practices for using threads effectively~~.		For detailed guidance on thread usage and best practices, please see the [[Thread Processing Guidance]] article.

	== Cloud Deployment Guidance ==		== Cloud Deployment Guidance ==

Dgreenwood: /* About Thread Allocation for Grooper Services */

2026-02-06T15:50:14Z

About Thread Allocation for Grooper Services

@@ Line 233: / Line 233: @@
 </div>
-== About Thread Allocation for Grooper Services ==
+== Thread processing guidance ==
-=== Understand the "n minus one" rule ===
+Grooper Activity Processing services distribute processing resources to automated tasks in a Batch Process. These services use your system's processing threads to do this. Other Grooper services (such as Import Watcher services) also use threads to perform their work.
-When Grooper services are installed, each service is assigned a number of CPU threads.
+Please visit the [[Thread Processing Guidance]] article for more information. This article explains how thread processing works and outlines best practices for using threads effectively.
 == Cloud Deployment Guidance ==

Dgreenwood: /* About Thread Allocation for Grooper Services */

2026-02-06T15:43:15Z

About Thread Allocation for Grooper Services

← Older revision		Revision as of 10:43, 6 February 2026
Line 239:		Line 239:
	When Grooper services are installed, each service is assigned a number of CPU threads.		When Grooper services are installed, each service is assigned a number of CPU threads.

	* ~~Some~~ services (for example, '''Import Watcher''') always run on a '''single thread'''.		* Certain services (for example, '''Import Watcher''') always run on a '''single thread'''.
	* '''Activity Processing''' services can use '''multiple threads'''.		* '''Activity Processing''' services can use '''multiple threads'''.

	~~Your~~ machine ~~has~~ a finite number of processing threads~~, and~~ '''~~over~~-allocating ~~them will~~ cause errors'''.		The machine provides a finite number of processing threads. '''Over-allocating threads may cause errors'''.
			The operating system must always have at least '''one thread available'''. Therefore, the total number of threads assigned to Grooper services must not exceed the number of available threads minus one.

	~~The operating system must always have at least~~ '''one ~~thread available~~'''~~. For that reason, the total number of threads assigned to Grooper services must never exceed the number of available threads minus one.~~		This principle is known as the '''"n minus one" rule''':

	~~This is known as the '''"n minus one" rule''':~~		* If '''n''' is the total number of threads available on the machine, the maximum number of threads that may be assigned to Grooper services is '''n − 1'''.

	* If '''n''' is the total number of threads available on the machine, the maximum number of threads ~~you~~ may ~~assign~~ to Grooper services is '''n − 1'''.

	=== Consider the "n minus x" rule ===		=== Consider the "n minus x" rule ===

	In ~~real-world~~ environments, Grooper is rarely the only ~~software~~ running.		In production environments, Grooper is rarely the only application running. Other software requires CPU threads, so additional reservations may be necessary:

	Other ~~applications also require~~ CPU threads, so additional reservations may be necessary:

	* '''SQL installed on the same machine'''		* '''SQL installed on the same machine'''
	** Follow an '''n − 2''' rule		** Follow an '''n − 2''' rule: 1 thread for the OS, 1 for SQL.
	** (1 thread for the OS, 1 for SQL)

	* '''SQL and IIS installed on the same machine'''		* '''SQL and IIS installed on the same machine'''
	** Follow an '''n − 3''' rule		** Follow an '''n − 3''' rule: 1 thread for the OS, 1 for SQL, 1 for IIS.
	** (1 thread for the OS, 1 for SQL, 1 for IIS)

	* '''Other background applications''' (for example, antivirus software)		* '''Other background applications''' (for example, antivirus software)
	* Reserve additional threads as needed		** Reserve additional threads as needed.

	~~This~~ is ~~one of the key reasons we recommend~~ '''~~distributing~~ SQL, IIS, and Grooper processing services across multiple machines''' whenever possible.		Therefore, it is recommended to '''distribute SQL, IIS, and Grooper processing services across multiple machines''' whenever possible.

	=== Bottom line ===		=== Bottom line ===

	'''Do not over-allocate ~~your~~ available threads.'''		* '''Do not over-allocate available threads.'''
	* If ~~you do~~, '''Grooper ~~can~~ behave erratically or fail unexpectedly'''.		* If threads are over-allocated, '''Grooper may behave erratically or fail unexpectedly'''.
	* Always leave sufficient CPU resources for the operating system and any supporting services.		* Always leave sufficient CPU resources for the operating system and any supporting services.