4

I am trying to run the Content Manager install for SDL Web 8.5, but I'm getting repeated failures to install the topology manager. By repeated, I mean that I've (more than once!) attempted a complete uninstall and re-install. (I've also tried a repair.) When it reaches the topology manager, I get this message: "Authorization has been denied for this request".

SDL Web installer failing

I've looked in the logging, and I can see that various files are reported to give problems: here's an example.

09/24/2017 10:07:05.630 [7620]: Assembly Install: Entering CAssemblyCache::UninstallAssembly(0, policy.8.5.Tridion.TopologyManager.Client,fileVersion="8.5.0.466",version="8.5.0.466",culture="neutral",publicKeyToken="DDFC895746E5EE6B",processorArchitecture="MSIL")

09/24/2017 10:07:05.864 [7620]: Assembly Install: Failing with hr=80070005 at RemoveDirectoryAndChildren, line 393

09/24/2017 10:07:05.864 [7620]: Detailed info about C:\Windows\assembly\temp\3Q7OPMJ17G\Microsoft.Practices.EnterpriseLibrary.Logging.dll

09/24/2017 10:07:05.864 [7620]: File attributes: 00000080

09/24/2017 10:07:06.007 [7620]: Restart Manager Info: 5 entries

09/24/2017 10:07:06.007 [7620]: App[0]: (7236) SDL Web Content Manager Service Host (TcmServiceHost), type = 3

09/24/2017 10:07:06.007 [7620]: App1: (8136) SDL Web Content Manager Workflow Agent (TCMWorkflow), type = 3

09/24/2017 10:07:06.007 [7620]: App[2]: (7180) SDL Web Content Manager Search Indexer (TcmSearchIndexer), type = 3

09/24/2017 10:07:06.007 [7620]: App[3]: (7016) SDL Web Content Manager Batch Processor (TcmBatchProcessor), type = 3

09/24/2017 10:07:06.008 [7620]: App[4]: (7292) SDL Web Content Manager Publisher (TcmPublisher), type = 3

09/24/2017 10:07:06.008 [7620]: Security info:

09/24/2017 10:07:06.008 [7620]: Owner: S-1-5-18

09/24/2017 10:07:06.008 [7620]: Group: S-1-5-18

09/24/2017 10:07:06.008 [7620]: DACL information: 5 entries:

09/24/2017 10:07:06.008 [7620]: ACE[0]: Type = 0x00, Flags = 010, Mask = 001f01ff, SID = S-1-5-18

09/24/2017 10:07:06.008 [7620]: ACE1: Type = 0x00, Flags = 010, Mask = 001f01ff, SID = S-1-5-32-544

09/24/2017 10:07:06.008 [7620]: ACE[2]: Type = 0x00, Flags = 010, Mask = 001200a9, SID = S-1-5-32-545

09/24/2017 10:07:06.009 [7620]: ACE[3]: Type = 0x00, Flags = 010, Mask = 001200a9, SID = S-1-15-2-1

09/24/2017 10:07:06.009 [7620]: ACE[4]: Type = 0x00, Flags = 010, Mask = 001200a9, SID = S-1-15-2-2

What can be causing this? How can I solve it? Are there any alternative approaches: perhaps a manual install of this component. If so, how would I go about it? Is there other logging I could look at that might help, or can I enable extra logging?

EDIT:

I've also found this message in the logs. It seems to match the message in the popup pretty well:

Begin CreateCMEntityExecute

CreateCMEntity: Delete user account _Tridion_Temp_User_.

CreateCMEntity: Create user account _Tridion_Temp_User_.

CreateCMEntity: Add user account _Tridion_Temp_User_ to group WEB85\Topology Manager Administrators.

Execute application 'net' with arguments 'localgroup "Topology Manager Administrators" "_Tridion_Temp_User_" /add'

CreateCMEntity: result '0'

CreateCMEntity: Add user account _Tridion_Temp_User_ to group S-1-5-32-544.

Execute application 'net' with arguments 'localgroup "Administrators" "_Tridion_Temp_User_" /add'

CreateCMEntity: result '0'

CreateCMEntity: Log on as user _Tridion_Temp_User_.

Website with id '1' is started

Website with id '4' is started

CreateCMEntity: Run PS command: Add-TtmCmEnvironment -Id 'Tridioncm_local' -CoreServiceRootUrl 'net.tcp://localhost:2660' -WebsiteRootUrl 'http://sdlweb:81' -AuthenticationType 'Windows' -UserName 'CRONINTECH\tridionsys' -Password '****' -TtmServiceUrl 'http://topman:82/ttm201601'.

CreateCMEntity: error Authorization has been denied for this request.

MSI (s) (08!30) [21:30:07:769]: Product: SDL Web Topology Manager -- Authorization has been denied for this request.

Authorization has been denied for this request.

CreateCMEntity: Delete user account _Tridion_Temp_User_.

CustomAction CreateCMEntityExecute returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)

I suspect that the problem is in part that the server is a domain controller. On the other hand, that should work, right? I deleted my local tridionsys account, but that didn't help.

Improve this question
4
  • 1
    The error message in the log hints at a file permissions issue in the GAC. Did you try running procmon.exe to get this confirmed?
    – Rick Pannekoek
    Commented Sep 25, 2017 at 6:22
  • I've spent some time with procmon. The install generates a LOT of activity. Still need to refine my filters to get anything useful.
    – Dominic Cronin
    Commented Sep 25, 2017 at 6:24
  • 1
    What kind of permissions are you running the installer as? Has it already installed the Topology Manager Groups? If so - add your user to the group and try again - i.sstatic.net/sTw3X.png
    – Tom Simm
    Commented Sep 25, 2017 at 8:41
  • 1
    Try using a procmon filter on Path contains policy.8.5.Tridion.TopologyManager
    – Rick Pannekoek
    Commented Sep 25, 2017 at 17:05

3 Answers 3

Reset to default
6

As I suspected based on the logging, it seems that the problem (at least indirectly) was that the server was a domain controller. This was the default setup for Windows Server, but I don't really need a DC, as the machine in question is just my own Tridion research image.

I removed Active Directory Domain services, and a few other things like DNS and Certificate server that were necessary to get the DC demoted and removed. After that, the Tridion CM installer worked like a charm, and I now appear to have a working Topology manager.

I think it's probably reasonable to want to run Tridion on a server that hosts a Domain Controller. I don't need to do it myself, but I can imagine scenarios where it would make sense. The exact problem I had is not completely clear, but I think it had something to do with putting restricted local accounts like NETWORK SERVICE into a domain group. I have no hard evidence, but it seems a reasonable interpretation of the error messages.

Is it a product issue? I can't really say. Perhaps someone at SDL has an opinion.

Improve this answer
4
  • Although it is not clear to me why installation on a DC would fail, it is considered bad practice to install applications on a DC (for example, see windowsitpro.com/windows-server/… ). Which scenarios do you imagine?
    – Rick Pannekoek
    Commented Sep 28, 2017 at 17:49
  • My guess is that on a DC, when you create a group, it's a domain group. Guessing though. The most obvious scenario is the fifth environment... do no biggie.
    – Dominic Cronin
    Commented Sep 28, 2017 at 21:30
  • What is “the fifth environment”? A stand-alone developer box? Why would you let that be a DC?
    – Rick Pannekoek
    Commented Sep 29, 2017 at 8:34
  • Yes - 5th env is a dev's box. In my case, I was using Windows Server Essentials, which comes out-of-the-box with a DC running. AFAICT it's a supported scenario. Maybe the easiest fix is just to stop supporting it, and update the docs to reflect this. I can't see any huge objections to that.
    – Dominic Cronin
    Commented Sep 30, 2017 at 21:55
2

I think this blog can solve your problem

If the above blog is not solving your problem try to add NETWORK SERVICE account in Administrator group on the server.

Regards Abhijit Angre

Improve this answer
1

Few things you may try:

  • Did you install using "Run As Administrator"
  • Can you verify the Database User you have used for Topology manager have appropriate access - may be you can try using the "sa" user while providing information for Topology Manger DB in the installer
  • I am sure you have done this, but can you re-check all Pre-Requisite needed and functioning correctly for SDL Web Content Manager
Improve this answer
1
  • Indeed - I ran it "As Administrator". The database user seems to be OK. Also - I think the pre-requisites are OK - which is also somewhat backed up by the fact that the installer checks them and doesn't complain.
    – Dominic Cronin
    Commented Sep 25, 2017 at 19:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.