Grooper Service - Revision history

Dgreenwood: /* Minimum service user rights */

2026-06-11T18:38:18Z

Minimum service user rights

@@ Line 98: / Line 98: @@
 ==== Minimum service user rights ====
+{{LeastPrivilegeServiceAccounts}}
 <!--- WIP uncomment once I can verify everything works

Dgreenwood: /* Least-privileged service accounts */

2026-05-28T18:58:00Z

Least-privileged service accounts

@@ Line 129: / Line 129: @@
+|
 Read and write access to the Grooper database
 |-
+|
@@ Line 140: / Line 141: @@
 ''These are the minimum permissions required by the Activity Processing service's user account. Other Grooper services may require additional permissions. For example, an Import Watcher's user may need access to directories used for importing file content.''
-<!---Come back to this when can verify Dustin's PowerShell script fully works
+<!--- WIP uncomment once I can verify everything works
 ==== Viewing, starting and stopping services with least-privileged service accounts ====
 -->

Dgreenwood: /* Services with "Error" statuses */

2026-05-20T19:27:37Z

Services with "Error" statuses

← Older revision		Revision as of 14:27, 20 May 2026
Line 149:		Line 149:
	When viewing services from the Machines node on the Design page you may see services with an error status.		When viewing services from the Machines node on the Design page you may see services with an error status.
	* "Error" is a general status Grooper uses when it can't determine if a service is running or stopped.		* "Error" is a general status Grooper uses when it can't determine if a service is running or stopped.
	* Most typically, "Error" indicates the '''~~request~~''' to get the service's status has failed.		* Most typically, "Error" indicates the '''query''' to get the service's '''status''' has failed.
	* In this case, the entity checking the status (the Grooper app pool user in IIS) does not have permission to check the service's status.		* In this case, the entity checking the status (the Grooper app pool user in IIS) does not have permission to check the service's status.
	* This doesn't necessarily mean the service is not running (nor does it mean it's stopped). It just means the app pool user can't verify its status.		* This doesn't necessarily mean the service is not running (nor does it mean it's stopped). It just means the app pool user can't verify its status.

Dgreenwood: /* Services with "Error" statuses */

2026-05-20T19:26:13Z

Services with "Error" statuses

← Older revision		Revision as of 14:26, 20 May 2026
Line 144:		Line 144:
	-->		-->

	=== Services with "Error" statuses ===		==== Services with "Error" statuses ====
			A common issue will occur with least-privileged accounts. This can cause some user confusion.
	[[File:2025Wiki GrooperServices ErrorStatus.png\|thumb\|right\|600px\|A service with an error status.]]		[[File:2025Wiki GrooperServices ErrorStatus.png\|thumb\|right\|600px\|A service with an error status.]]
	When viewing services from the Machines node on the Design page you may see services with an error status.		When viewing services from the Machines node on the Design page you may see services with an error status.
Line 151:		Line 152:
	* In this case, the entity checking the status (the Grooper app pool user in IIS) does not have permission to check the service's status.		* In this case, the entity checking the status (the Grooper app pool user in IIS) does not have permission to check the service's status.
	* This doesn't necessarily mean the service is not running (nor does it mean it's stopped). It just means the app pool user can't verify its status.		* This doesn't necessarily mean the service is not running (nor does it mean it's stopped). It just means the app pool user can't verify its status.

			This issue does not occur when service accounts have administrator rights, as broad access is granted by default. For '''least-privileged''' accounts, however, the service DACL must be explicitly modified to grant the rights needed to query status, start, and stop the service.


Line 158:		Line 161:
	* The user "DOMAIN\grooperapp" does not have permissions to access GRPACT01. So, it cannot verify the status of services installed on that machine.		* The user "DOMAIN\grooperapp" does not have permissions to access GRPACT01. So, it cannot verify the status of services installed on that machine.
	* When any user opens up the Grooper web app, they will see the services installed on GRPACT01 listed with an "Error" status.		* When any user opens up the Grooper web app, they will see the services installed on GRPACT01 listed with an "Error" status.

	~~This scenario can be resolved if the Grooper app pool user in IIS is also an admin user on the processing server(s) running Grooper services.~~

	=== Addressing "ghost services" - Deleting services from Windows ===		=== Addressing "ghost services" - Deleting services from Windows ===

Dgreenwood: /* Viewing, starting and stopping services with least-privileged service accounts */

2026-05-20T19:14:11Z

Viewing, starting and stopping services with least-privileged service accounts

← Older revision		Revision as of 14:14, 20 May 2026
Line 140:		Line 140:
	''These are the minimum permissions required by the Activity Processing service's user account. Other Grooper services may require additional permissions. For example, an Import Watcher's user may need access to directories used for importing file content.''		''These are the minimum permissions required by the Activity Processing service's user account. Other Grooper services may require additional permissions. For example, an Import Watcher's user may need access to directories used for importing file content.''

			<!---Come back to this when can verify Dustin's PowerShell script fully works
	==== Viewing, starting and stopping services with least-privileged service accounts ====		==== Viewing, starting and stopping services with least-privileged service accounts ====
			-->

	=== Services with "Error" statuses ===		=== Services with "Error" statuses ===

Dgreenwood: /* Least-privilege service accounts */

2026-05-19T19:15:27Z

Least-privilege service accounts

← Older revision		Revision as of 14:15, 19 May 2026
Line 95:		Line 95:
	== Additional info ==		== Additional info ==

	=== Least-~~privilege~~ service accounts ===		=== Least-privileged service accounts ===

	==== Minimum service user rights ====		==== Minimum service user rights ====
Line 139:		Line 139:

	''These are the minimum permissions required by the Activity Processing service's user account. Other Grooper services may require additional permissions. For example, an Import Watcher's user may need access to directories used for importing file content.''		''These are the minimum permissions required by the Activity Processing service's user account. Other Grooper services may require additional permissions. For example, an Import Watcher's user may need access to directories used for importing file content.''

			==== Viewing, starting and stopping services with least-privileged service accounts ====

	=== Services with "Error" statuses ===		=== Services with "Error" statuses ===

Dgreenwood: /* Service user rights */

2026-05-18T12:52:07Z

Service user rights

← Older revision		Revision as of 07:52, 18 May 2026
Line 95:		Line 95:
	== Additional info ==		== Additional info ==

	=== ~~Service~~ user rights ===		=== Least-privilege service accounts ===

			==== Minimum service user rights ====

	The Grooper Service user account must have the following permissions:		The Grooper Service user account must have the following permissions:

Dgreenwood: /* Addressing "ghost services" - Deleting services from Windows */

2026-01-07T14:33:54Z

Addressing "ghost services" - Deleting services from Windows

← Older revision		Revision as of 09:33, 7 January 2026
Line 157:		Line 157:
	=== Addressing "ghost services" - Deleting services from Windows ===		=== Addressing "ghost services" - Deleting services from Windows ===

	Very rarely, a Grooper service will not uninstall properly when you uninstall a Grooper service ~~service~~. Or, a user may delete a Grooper Repository connection or purge a Grooper Repository without uninstalling services first.		Very rarely, a Grooper service will not uninstall properly when you uninstall a Grooper service instance. Or, a user may delete a Grooper Repository connection or purge a Grooper Repository without uninstalling services first.

	This can make it appear as though a duplicate or "ghost" Windows service is installed without being listed in GCC (or Grooper Config before version 2024).		This can make it appear as though a duplicate or "ghost" Windows service is installed without being listed in GCC (or Grooper Config before version 2024).

Dgreenwood: /* Services with "Error" statuses */

2026-01-07T14:27:59Z

Services with "Error" statuses

← Older revision		Revision as of 09:27, 7 January 2026
Line 141:		Line 141:
	[[File:2025Wiki GrooperServices ErrorStatus.png\|thumb\|right\|600px\|A service with an error status.]]		[[File:2025Wiki GrooperServices ErrorStatus.png\|thumb\|right\|600px\|A service with an error status.]]
	When viewing services from the Machines node on the Design page you may see services with an error status.		When viewing services from the Machines node on the Design page you may see services with an error status.
			* "Error" is a general status Grooper uses when it can't determine if a service is running or stopped.
	* Most typically, "Error" indicates the '''request''' to get the service's status has failed.		* Most typically, "Error" indicates the '''request''' to get the service's status has failed.
	* In this case, the entity checking the status (the Grooper app pool user in IIS) does not have permission to check the service's status.		* In this case, the entity checking the status (the Grooper app pool user in IIS) does not have permission to check the service's status.

Dgreenwood: /* Services with "Error" statuses */

2026-01-07T14:26:16Z

Services with "Error" statuses

← Older revision		Revision as of 09:26, 7 January 2026
Line 151:		Line 151:
	* The user "DOMAIN\grooperapp" does not have permissions to access GRPACT01. So, it cannot verify the status of services installed on that machine.		* The user "DOMAIN\grooperapp" does not have permissions to access GRPACT01. So, it cannot verify the status of services installed on that machine.
	* When any user opens up the Grooper web app, they will see the services installed on GRPACT01 listed with an "Error" status.		* When any user opens up the Grooper web app, they will see the services installed on GRPACT01 listed with an "Error" status.

			This scenario can be resolved if the Grooper app pool user in IIS is also an admin user on the processing server(s) running Grooper services.

	=== Addressing "ghost services" - Deleting services from Windows ===		=== Addressing "ghost services" - Deleting services from Windows ===