Setting the Windows service account

I recently helped a site investigate a problem that appeared after they upgraded their Windows instance of Caché from 2015.1 to 2017.1. A terminal session launched from the server's desktop cube was unable to run OS-level commands using the $ZF(-1) function. For instance, using the no-op command "REM" as follows:

write $zf(-1,"rem")

was returning -1, indicating that the Windows command could not be issued.

It turned out that their original 2015.1 Caché service was running under a specific Windows account (as opposed to LocalSystem), which is commonly done in order to allow background processes to access UNC shares. Indeed, when installing with Normal or Locked Down security you are prompted for the credentials of a Windows account to run the service as.

When upgrading to 2017.1 they missed the info here that explains why cinstall.exe needs to be used whenever setting the service account:

<installdir>\bin\cinstall setserviceusername <InstanceName> <username> <password>

It turned out that even though they weren't changing which account their upgraded instance ran as, they still needed to use this command in order to give the account the necessary permissions.

I'm posting the info here in case it helps someone in future.