New post
Question
· May 27, 2020

Scheduled Task User privilege

#Security #System Administration #Access control #Caché

   Hi,

 I've started to use Task Schedule function in Caché. But I have two questions about it:

  1. I want to run the task as an indepedent, technical user. What is the minimum resources for this user to successfully run the defined task.
  2. I disabled the built in user _SYSTEM, as the Tightening Security for an Instance article suggest. But I see that built in task run in the name of _SYSTEM user. For example Switch Journal. How can this work, if the user disabled? Should I use another user for this tasks?

Thanks!

Discussion (4)1
Log in or sign up to continue
Vic Sun · May 27, 2020

Hello István,

You can find in the docs the following:

Using the Task Manager

"If the chosen user is disabled, the task is suspended until the user is enabled and the task is resumed manually. This does not apply to built-in System tasks, which run even when the chosen user is disabled."

While the system tasks will still work while assigned to run as the disabled _SYSTEM user, it might be a good idea to set them to another user with similar permissions for clarity's sake.

The necessary resources for a task are totally dependent on what the task needs to do.

0 0
István Nagy · May 27, 2020

   Hello,

"If the chosen user is disabled, the task is suspended until the user is enabled and the task is resumed manually. This does not apply to built-in System tasks, which run even when the chosen user is disabled."

This sentence is absent in my Cache version's documentation (Caché 2012.2). Thank you!

I made a user with privilage %DB_DATABASE and %Operate for running a task. But it fails (<INVALID OREF>zRunTask+46^%SYS.TaskSuper.1). If I run the task as my user profile (%All), it succeed.  I add %All privilage to target user, but the task fails too. What privilege is missing?

0 0
Vic Sun · May 27, 2020

%ALL should cover everything from the Caché side so I suspect an OS permissions difference. Is the task doing anything that requires OS permissions (this could include writing to an output file)? Do the Caché OS user and the OS user corresponding to your account differ? What other differences could you think of between the two users? Without looking around your system I think it will be tough to troubleshoot this, so I'd recommend reaching out to the WRC.

Also, you probably already know this, but 2012 is quite an old version - I'd definitely recommend upgrading if possible.

0 0