Configuring service account for publisher service

Question

We are trying to configure a different service account other than MTS User and in the process we gave full control for publisher's root folder and transaction folder as well.

Ran a command C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe -pa TridionRsaKeyContainer domain\<publisher service account>

Made the publisher service to logon with publisher service account.

Once all the above steps are done and publisher service is restarted an error is logged in event log as below.

Error when calling method 'GetDeploymentNotification' of the object 'cd_transport.Transport'.
Retrieving the COM class factory for component with CLSID {FDD3F879-14B4-4492-9A45-B640B3EA3E07} failed due to the following error: 80070005 Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)).
Component: Tridion.ContentManager.Publishing
Errorcode: 0
User: domain\pubserviceaccount
StackTrace Information Details:
at Tridion.ContentManager.Publishing.Transporting.TransportEngine.GetDeploymentFeedback()
at Tridion.ContentManager.Publishing.Transporting.TransportEngine.GetDeploymentFeedback()
at Tridion.ContentManager.Publishing.Publisher.DeploymentFeedbackHandler.DoWork()*

Are we missing out something?

Answer 1

As indicated by Bart, it should be configured in Tridion as admin user and necessary permissions needs to be given to the publisher service account as mentioned here

The issue came up mainly because of 2 things,

• Our publisher service account did not had admin privileges in Tridion

• Neccessary permissions weren't in place on folders for publisher service account.

All in all nice learning and it is working fine now.

Answer 2

The default identity for the Publisher Service is Local System, this is impersonated when the Publisher runs, as the Publisher requires CM Admin rights to run (it needs access to all items that are being published). The documentation (requires login) mentions this at the bottom of the User account table:

Of these accounts, the following must be system administrator-level accounts in Content Manager:

• tcmpublisher
• tcmsearchindexer
• tcmworkflow

So when you change the identity of the Publisher Service (or one of the other two listed above), you have to ensure you change that either into a CM Administrator account or an impersonation user (so that it can be impersonated to obtain administrator rights), but since it needs Administration rights you might as well add the user itself to SDL Tridion (else you could have left it as the default Local System identity).

Note: by default NT AUTHORITY\NETWORK SERVICE (the Network Service account) is listed as an Impersonation user in the SDL Tridion MMC snap-in, and I believe NT AUTHORITY\SYSTEM (the Local System account) is a default impersonation user already.