4

Scenario: Sometime, client's IT policies does not allow us to have a user with Admin right that we can use as MTS user to install SDL Tridion

Query:

What are the minimum access rights needed to use a domain user as an MTS user, since as per the IT policy, I have observed that a domain user with Local Admin rights was not able to function as MTS User

7

Follow below steps to make a (non-administrator) domain user to act as an MTS user:

  1. Give the user Read rights on the Tridion installation location (defaults to C:\Program files(x86)\Tridion) which in turn will inherit down to the other directory levels. Also give read and write access on the C:\windows\temp directory on the server.
  2. Restart the Tridion COM+ application and all Tridion services on the CM server.
  3. Open the security policy configuration manager by running following command 'SecPol.msc' and perform following steps.
    • Add the domain MTSUser itself to the 'Allow log on locally' Local Security Policy.
    • Add the domain MTSUser itself to the 'Log on as a batch job' Local Security Policy.
    • Add the domain MTSUser itself to the 'Log on as a service' Local Security Policy.
    • Add the domain MTSUser itself to the 'Take ownership of files and other objects' Local Security Policy.
    • Add the domain MTSUser itself to the 'Act as par of the operating system'
    • Add the domain MTSUser itself to the 'Impersonate a client after authentication.
  4. On CMS Server Run the following command from the command line from .Net framework directory (i.e.C:\Windows\Microsoft .Net\Framework64\v4.0):

    aspnet_regiis -pa "TridionRsaKeyContainer" "[domain]\[MTS User name]".

  5. Restart IIS and the Tridion COM+ application after successfully running this command.

After following above mentioned steps you can use this user as an MTS user.

A document regarding same can be seen at my blog HERE

4
  • That looks like more than you used to have to do. For example, does the account need Log on as a Service?, act as part of the operating system? Impersonate a client....?
    – Dominic Cronin
    Jan 6 '14 at 22:26
  • Yes Dominic. We have experienced in SDL Tridion 2011 (Not SP1) that without these rights, few of the functionality does not work. Also, I have just put the information here which I have received from SDL Support after raising ticket and have multiple discussion with them. Just formatted the information and put it here for reference so that it will be helpful for anybody looking for it. :) Jan 7 '14 at 6:00
  • Maybe it helps to be clearer about what your MTSUser account is used for. For example, you shouldn't need 'Log on as a service' unless you need to run a service.
    – Dominic Cronin
    Jan 7 '14 at 6:44
  • Right Dominic. I tried to put up in the question (& answer) if not Admin rights then what are the minimum access rights should be used for MTS User with Which SDL Tridion can be used to perform all its activities - whether it is Core Service or OData Service or the Content Porter (without any customization and with default Tridion Installation) Jan 7 '14 at 7:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.