Grooper Service - Revision history

Dgreenwood: /* Services with "Error" statuses */

2026-10-21T15:35:08Z

Services with "Error" statuses

← Older revision		Revision as of 10:35, 21 October 2026
Line 202:		Line 202:
	* Before this version, a service without broad administrative rights on a machine would show "Error" as its stats regardless of whether it was running and it could not be stopped and started.		* Before this version, a service without broad administrative rights on a machine would show "Error" as its stats regardless of whether it was running and it could not be stopped and started.
	* After this version, the service account will be granted remote start/stop rights on install and the service's status will be visible from the Machines folder.		* After this version, the service account will be granted remote start/stop rights on install and the service's status will be visible from the Machines folder.
	*<li class="attn-bullet"> In distributed environments, where the services and web client are installed on separate servers, the web client '''must''' be upgraded to 25.0.0057 or newer as well in order to start and stop the service from the Design page.		**<li class="attn-bullet"> In distributed environments, where the services and web client are installed on separate servers, the web client '''must''' be upgraded to 25.0.0057 or newer as well in order to start and stop the service from the Design page.

	This not only makes it easier to manage services from the Design page, but also makes it much more clear when services are in "error" for a more legitimate reason, such as the server being down.		This not only makes it easier to manage services from the Design page, but also makes it much more clear when services are in "error" for a more legitimate reason, such as the server being down.

Dgreenwood: /* Services with "Error" statuses */

2026-10-21T15:30:49Z

Services with "Error" statuses

← Older revision		Revision as of 10:30, 21 October 2026
Line 202:		Line 202:
	* Before this version, a service without broad administrative rights on a machine would show "Error" as its stats regardless of whether it was running and it could not be stopped and started.		* Before this version, a service without broad administrative rights on a machine would show "Error" as its stats regardless of whether it was running and it could not be stopped and started.
	* After this version, the service account will be granted remote start/stop rights on install and the service's status will be visible from the Machines folder.		* After this version, the service account will be granted remote start/stop rights on install and the service's status will be visible from the Machines folder.
			*<li class="attn-bullet"> In distributed environments, where the services and web client are installed on separate servers, the web client '''must''' be upgraded to 25.0.0057 or newer as well in order to start and stop the service from the Design page.

	This not only makes it easier to manage services from the Design page, but also makes it much more clear when services are in "error" for a more legitimate reason, such as the server being down.		This not only makes it easier to manage services from the Design page, but also makes it much more clear when services are in "error" for a more legitimate reason, such as the server being down.

Dgreenwood: /* Services with "Error" statuses */

2026-10-21T13:45:03Z

Services with "Error" statuses

← Older revision		Revision as of 08:45, 21 October 2026
Line 198:		Line 198:

	==== Services with "Error" statuses ====		==== Services with "Error" statuses ====
	~~A common issue will occur with least-privileged accounts. This can cause some user confusion.~~
	[[File:2025Wiki GrooperServices ErrorStatus.png\|thumb\|right\|600px\|A service with an error status.]]		[[File:2025Wiki GrooperServices ErrorStatus.png\|thumb\|right\|600px\|A service with an error status.]]
	~~When viewing services from the Machines node on the Design page you may see services~~ with ~~an error status~~.		Prior to version '''25.0.0057''', there was a common issue will occur with least-privileged accounts that caused users confusion. This can cause some user confusion.
	* "Error" ~~is a general status Grooper uses when~~ it ~~can't determine if a service is~~ running or stopped.		* Before this version, a service without broad administrative rights on a machine would show "Error" as its stats regardless of whether it was running and it could not be stopped and started.
	* ~~Most typically~~, ~~"Error" indicates the '''query''' to get~~ the service~~'s '''status''' has failed.~~		* After this version, the service account will be granted remote start/stop rights on install and the service's status will be visible from the Machines folder.
	* In this case, the entity checking the status (the Grooper app pool user in IIS) does not have permission to check the service's status.
	* This doesn't necessarily mean the ~~service is not running (nor does it mean it's stopped). It just means the app pool user can't verify its status~~.

	This ~~issue does~~ not ~~occur~~ when ~~service accounts have administrator rights~~, as ~~broad access is granted by default~~. ~~For '''least~~-~~privileged''' accounts, however~~, the service DACL must be explicitly modified to grant the rights needed to query status, start, and stop the service.		This not only makes it easier to manage services from the Design page, but also makes it much more clear when services are in "error" for a more legitimate reason, such as the server being down.
			*<li class="attn-bullet"> Only newly installed services in 25.0.0057 and after will receive these additional rights. Existing services must be re-created for GCC to grant these rights. Otherwise, the service DACL must be explicitly modified to grant the rights needed to query status, start, and stop the service.

	~~Example Scenario:~~
	* The Grooper Web Client is installed on web server named GRPWEB01. The user "DOMAIN\grooperapp" is the app pool user in IIS
	* Grooper Activity Processing services are installed on a processing server named GRPACT01.
	* The user "DOMAIN\grooperapp" does not have permissions to access GRPACT01. So, it cannot verify the status of services installed on that machine.
	* When any user opens up the Grooper web app, they will see the services installed on GRPACT01 listed with an "Error" status.

	=== Addressing "ghost services" - Deleting services from Windows ===		=== Addressing "ghost services" - Deleting services from Windows ===

Dgreenwood: /* Addressing "ghost services" - Deleting services from Windows */

2026-09-18T20:05:40Z

Addressing "ghost services" - Deleting services from Windows

← Older revision		Revision as of 15:05, 18 September 2026
Line 229:		Line 229:
	</pre>		</pre>

	'''''OR'''''		'''''AND/OR'''''

	You ~~can~~ delete the service from the Windows Registry Editor, using the following steps:		You may need to delete the service from the Windows Registry Editor, using the following steps:
	# Open the Registry Editor (regedit.exe)		# Open the Registry Editor (regedit.exe)
	# Navigate to <code>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services</code>.		# Navigate to <code>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services</code>.

Dgreenwood: /* Minimum service user rights */

2026-06-11T18:38:18Z

Minimum service user rights

@@ Line 98: / Line 98: @@
 ==== Minimum service user rights ====
+{{LeastPrivilegeServiceAccounts}}
 <!--- WIP uncomment once I can verify everything works

Dgreenwood: /* Least-privileged service accounts */

2026-05-28T18:58:00Z

Least-privileged service accounts

@@ Line 129: / Line 129: @@
+|
 Read and write access to the Grooper database
 |-
+|
@@ Line 140: / Line 141: @@
 ''These are the minimum permissions required by the Activity Processing service's user account. Other Grooper services may require additional permissions. For example, an Import Watcher's user may need access to directories used for importing file content.''
-<!---Come back to this when can verify Dustin's PowerShell script fully works
+<!--- WIP uncomment once I can verify everything works
 ==== Viewing, starting and stopping services with least-privileged service accounts ====
 -->

Dgreenwood: /* Services with "Error" statuses */

2026-05-20T19:27:37Z

Services with "Error" statuses

← Older revision		Revision as of 14:27, 20 May 2026
Line 149:		Line 149:
	When viewing services from the Machines node on the Design page you may see services with an error status.		When viewing services from the Machines node on the Design page you may see services with an error status.
	* "Error" is a general status Grooper uses when it can't determine if a service is running or stopped.		* "Error" is a general status Grooper uses when it can't determine if a service is running or stopped.
	* Most typically, "Error" indicates the '''~~request~~''' to get the service's status has failed.		* Most typically, "Error" indicates the '''query''' to get the service's '''status''' has failed.
	* In this case, the entity checking the status (the Grooper app pool user in IIS) does not have permission to check the service's status.		* In this case, the entity checking the status (the Grooper app pool user in IIS) does not have permission to check the service's status.
	* This doesn't necessarily mean the service is not running (nor does it mean it's stopped). It just means the app pool user can't verify its status.		* This doesn't necessarily mean the service is not running (nor does it mean it's stopped). It just means the app pool user can't verify its status.

Dgreenwood: /* Services with "Error" statuses */

2026-05-20T19:26:13Z

Services with "Error" statuses

← Older revision		Revision as of 14:26, 20 May 2026
Line 144:		Line 144:
	-->		-->

	=== Services with "Error" statuses ===		==== Services with "Error" statuses ====
			A common issue will occur with least-privileged accounts. This can cause some user confusion.
	[[File:2025Wiki GrooperServices ErrorStatus.png\|thumb\|right\|600px\|A service with an error status.]]		[[File:2025Wiki GrooperServices ErrorStatus.png\|thumb\|right\|600px\|A service with an error status.]]
	When viewing services from the Machines node on the Design page you may see services with an error status.		When viewing services from the Machines node on the Design page you may see services with an error status.
Line 151:		Line 152:
	* In this case, the entity checking the status (the Grooper app pool user in IIS) does not have permission to check the service's status.		* In this case, the entity checking the status (the Grooper app pool user in IIS) does not have permission to check the service's status.
	* This doesn't necessarily mean the service is not running (nor does it mean it's stopped). It just means the app pool user can't verify its status.		* This doesn't necessarily mean the service is not running (nor does it mean it's stopped). It just means the app pool user can't verify its status.

			This issue does not occur when service accounts have administrator rights, as broad access is granted by default. For '''least-privileged''' accounts, however, the service DACL must be explicitly modified to grant the rights needed to query status, start, and stop the service.


Line 158:		Line 161:
	* The user "DOMAIN\grooperapp" does not have permissions to access GRPACT01. So, it cannot verify the status of services installed on that machine.		* The user "DOMAIN\grooperapp" does not have permissions to access GRPACT01. So, it cannot verify the status of services installed on that machine.
	* When any user opens up the Grooper web app, they will see the services installed on GRPACT01 listed with an "Error" status.		* When any user opens up the Grooper web app, they will see the services installed on GRPACT01 listed with an "Error" status.

	~~This scenario can be resolved if the Grooper app pool user in IIS is also an admin user on the processing server(s) running Grooper services.~~

	=== Addressing "ghost services" - Deleting services from Windows ===		=== Addressing "ghost services" - Deleting services from Windows ===

Dgreenwood: /* Viewing, starting and stopping services with least-privileged service accounts */

2026-05-20T19:14:11Z

Viewing, starting and stopping services with least-privileged service accounts

← Older revision		Revision as of 14:14, 20 May 2026
Line 140:		Line 140:
	''These are the minimum permissions required by the Activity Processing service's user account. Other Grooper services may require additional permissions. For example, an Import Watcher's user may need access to directories used for importing file content.''		''These are the minimum permissions required by the Activity Processing service's user account. Other Grooper services may require additional permissions. For example, an Import Watcher's user may need access to directories used for importing file content.''

			<!---Come back to this when can verify Dustin's PowerShell script fully works
	==== Viewing, starting and stopping services with least-privileged service accounts ====		==== Viewing, starting and stopping services with least-privileged service accounts ====
			-->

	=== Services with "Error" statuses ===		=== Services with "Error" statuses ===

Dgreenwood: /* Least-privilege service accounts */

2026-05-19T19:15:27Z

Least-privilege service accounts

← Older revision		Revision as of 14:15, 19 May 2026
Line 95:		Line 95:
	== Additional info ==		== Additional info ==

	=== Least-~~privilege~~ service accounts ===		=== Least-privileged service accounts ===

	==== Minimum service user rights ====		==== Minimum service user rights ====
Line 139:		Line 139:

	''These are the minimum permissions required by the Activity Processing service's user account. Other Grooper services may require additional permissions. For example, an Import Watcher's user may need access to directories used for importing file content.''		''These are the minimum permissions required by the Activity Processing service's user account. Other Grooper services may require additional permissions. For example, an Import Watcher's user may need access to directories used for importing file content.''

			==== Viewing, starting and stopping services with least-privileged service accounts ====

	=== Services with "Error" statuses ===		=== Services with "Error" statuses ===