topic Re: Qlik Sense Desktop without admin rights and Group Policy control on running .exes in Management & Governance

Qlik Sense Desktop without admin rights and Group Policy control on running .exes

Anonymous — Tue, 08 Mar 2016 22:38:43 GMT

We tried to install Qlik Sense Desktop on a couple of machines at work without success. The program seems to be quite unconventional as regards where it puts files and runs them from.

Our environment is a typical Windows corporate system: roaming profiles; users don't have local admin rights; group policy will block an exe from running unless it's located in an authorised folder (ie, a folder where the user has no write control - eg C:\Program Files).

In order to install the software it was necessary to temporarily give the user local admin rights and to temporarily change the personal folder registry setting in HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Personal from a network to a local drive.

Having managed to install it, we couldn't run it because the main executable is in the user's AppData directory, under Local\Programs\Qlik\Sense, so Group Policy blocks it.

Moving the Qlik directory to a whitelisted directory such as C:\Program Files means that the exe runs but doesn't work: the browser window never opens and while the server component seems to run - at least it listens on port 4848 - it never replies. The Event Log fills up with event id 300s. A "Start_Engine" log file is produced but only gets as far as Initiating server license.

It appears that there are whole bunch of other directories that are created when the application runs (on first run or every time?), for example:

%USERPROFILE%\AppData\Local\Programs
- Common
- Common Files
%USERPROFILE%\AppData\Local\Temp
- DataPrepService2.2.50501.0409.10
- MigrationService2.2.50501.0409.10
- QlikSenseBrowser2.2.50501.0409.10
- SensePrinting2.2.50501.0409.10

Running exe files from these directories is not an option is our environment.

Are these locations configurable? In particular, is there way to allow the app the necessary write access (log files, caches, etc) while keeping the exe files somewhere read-only?

Re: Qlik Sense Desktop without admin rights and Group Policy control on running .exes

till_bentz — Wed, 20 Apr 2016 07:46:47 GMT

Hello Tom,

I was wondering if you found a solution for this problem. We have pretty much the same setup and therefore the same problems...

Regards,

Till

Re: Qlik Sense Desktop without admin rights and Group Policy control on running .exes

Anonymous — Tue, 03 May 2016 21:16:34 GMT

No luck, I'm afraid.

Re: Qlik Sense Desktop without admin rights and Group Policy control on running .exes

ecagriculture — Tue, 31 Jan 2017 09:23:26 GMT

Hi Tom,

Your set-up is quite standard and similar to ours so we encounter exactly the same problem...

Did you ever open a support call for this or have you found another solution?

Any reaction from Qlik?

kind regards,

William

Re: Qlik Sense Desktop without admin rights and Group Policy control on running .exes

till_bentz — Tue, 07 Mar 2017 09:21:50 GMT

Hi William,

I'm not sure if this is still an open question. But I had contact with Qlik support regarding this question. Apparently the requirements for Sense Desktop are among others 64bit non-server OS and (local) admin rights.

I know its not really a solution but maybe it helps anyway.

Regards,

Till

Re: Qlik Sense Desktop without admin rights and Group Policy control on running .exes

Anonymous — Mon, 08 May 2017 16:52:40 GMT

Our company seems to have found a solution using a container or virtual machine where the user can have admin rights without affecting other things.

It is a bit slow and occasionally stops working, but better than nothing.

I believe that Qlik could remove the need for admin rights by allowing us to change some of the default file locations and port numbers.

Re: Qlik Sense Desktop without admin rights and Group Policy control on running .exes

stantrolav — Wed, 10 May 2017 12:35:16 GMT

Hi!

Every time I fight with this old-school security rights. New software need more privileges rather than Notepad. Give user full access to his system folder:

%USERPROFILE%\

This folder is used by user and must be opened for him. Also for stabile work user must have privileges for changing his Registry change in Windows HKCU\

Re: Qlik Sense Desktop without admin rights and Group Policy control on running .exes

Anonymous — Wed, 10 May 2017 12:58:35 GMT

The issue is not write permissions but execute permissions. It's quite reasonable to limit these. One solution we haven't tried is to identify and whitelist all the .exes that Qlik Sense creates and runs. The fact that these are only created at run time, not on installation, might be a problem.

Re: Qlik Sense Desktop without admin rights and Group Policy control on running .exes

ecagriculture — Wed, 10 May 2017 14:40:44 GMT

Hi,

We had to find a solution for our training room and we found a working solution (in cooperation with our technical friends).

We copied the whole qliksense installation folder to a folder from which users can execute programs (but users themselves don't have a write access to it). In our case c:\pgm which was created previously for these kind of situations...

We encountered a problem with logins that tried Qliksense in the past on these workstations, so we added in the copy procedure the following:

rename the ...\AppData\Local\Programs\Qlik folder to Qlik_old

rename the ...\AppData\Local\Programs\Common Files to Common Files_old

and we put a shortcut on the desktop that points to:

c:\PGM\Qlik\Sense\QliksenseBrowser\qlikSenseBrowser.exe

and it seems to work without admin rights (we use training accounts which have only very limited permissions), only odbc connections give a problem, but this was not necessary for our course.

I can publish the script but i need to remove first a few company related lines...

Attention, this is for version 3.1SR3 of Qliksense, in 3.2 there is a server authentication necessary..., we don't know yet how to tackle this for the trainingroom...

Kind regards,

Wiliam

Re: Qlik Sense Desktop without admin rights and Group Policy control on running .exes

mikestone519 — Tue, 31 Oct 2017 13:39:07 GMT

Exactly the same thing here. I've never seen an application installer that assumes so much about where it will be installed. Assuming the end-user will have admin rights is a sin.

Re: Qlik Sense Desktop without admin rights and Group Policy control on running .exes

Boba-Fat — Mon, 02 Dec 2019 14:47:06 GMT

Qlik really need to sort this out. Security best practices insist on the concept of "least privilege" for users and this flies in the face of that, forcing us to give users local admin rights which is a great way for malware to get a foothold on a network.

Re: Qlik Sense Desktop without admin rights and Group Policy control on running .exes

ivan_will — Wed, 12 Aug 2020 13:27:52 GMT

This issue can be resolved by making sure the account is actually a Service Account. Even Administrative accounts are NOT service accounts unless specified.

Depending on the Windows OS version you can do the following:

1. Open Administrative Tools (older versions, Control Panel, new versions, click on Start)

2. Select Local Security Policy, expand Local Policies, click on User Rights Assignment

3. Select Act as part of the operating system. If your user is already listed, skip to Step 5

4. Click on Add User or Group and add the desired user account. Click on Check Names and make note of the entire name, example: MYHOST\myservice

5. Return to the listing for User Rights Assignment and select Log on as a service, following the same directions as above

6. Close Administrative Tools and return to the Sense installation

6. Using the same exact name that appeared with Check Names, enter the service account name in the User dialog, with the correct password.

Re: Qlik Sense Desktop without admin rights and Group Policy control on running .exes

ivan_will — Tue, 17 Nov 2020 10:33:06 GMT

Second possible resolution might be:

The issue with the installation may come from using the wrong computer/maschine name!
Somehow it accepts the user and credentials but then fails, the easiest way is to use the exact name of machine name/user name taken from the properties of a file, security tab and then use the account full name from there.

Hope the above helps.
Stay safe