Dedicated NPrinting Server & Engine Service Account Configuration

Frank_S — Mon, 22 Jul 2024 15:49:07 GMT

Requirements and Limitations

NPrinting Connections with QlikView

NPrinting requires a Dedicated NPrinting server service user account and a dedicate Named CAL/Desktop license associated with this 'domain' service user account.
If you have only a single NPrinting Engine and NP server, then the NP service account used to install and run the NPrinting server can also be used to run the single NPrinting Engine service.
However, if you have more than one NP engine, you will require separate dedicated NP service accounts for each additional NPrinting Engine.
Sharing service user accounts between different NPrinting and QlikView servers is is NOT a supported configuration. One NPrinting Dedicated Service Account per NPrinting Engine is required.
Shared Account failures: If you are using a service account that is in daily use by separate NPrinting Engine, QlikView user or QlikView server, this will cause contention issues due to the attempt to share a user QlikView CAL between two separate server environments. Doing so will inevitably cause failure in normal NPrinting operation.
- Expected failure behavior of a 'shared' NPrinting service account is that NPrinting Schedules and Tasks get will get hung up in the background server service due to contention between the QlikView services and the NPrinting Engine service

QlikView Personal Edition is not supported. A valid User CAL must be assigned to the NPrinting service account or QV desktop license installed while logged on as the NPrinting service account.
Alternate identities are not supported: ie: qvp://nprinting_svc@qlikviewserver1/qwvs/salesdemo.qvw
Default user rights assignments have been modified or changed by local or network active directory group policy.

NOTE: Do NOT change/replace any of the NPrinting default system service user accounts

QlikView Verification Error

x The QlikView Desktop License is valid

NOTE: With QVP NPrintng Connections the QV desktop installed on the NPrinting Server MUST be the same version as the QVS QlikView Server. You will experience NP Verification errors if they are not the same version.

To ensure NPrinting Connections work correctly, it is critical to ensure that the above requirements are met. Then take the following steps:

1. Create a dedicated account, which:

is a domain account that is a member of the local Administrators group on the NPrinting server and the QlikView Administrators group on the QlikView server
has a manually assigned CAL from a PRODUCTION ONLY QlikView Management Console (QMC) or a locally installed QlikView desktop license. (a QlikView TEST server does not issue valid user CALs for use with NPrinting Production reporting. If you are operating a Proof of Concept, please contact your Qlik Account Manager who can arrange a QlikView server PROD Trial License)
has 'log on as a service' user rights assignment applied to it
is not be shared with any other NPrinting server environment or QlikView server. Each NPrinting Environment MUST have its own NPrinting server service account
Alternate identities are not supported: ie: qvp://nprinting_svc@qlikviewserver1/qwvs/salesdemo.qvw
other than "log on as as service", all default domain policies associated with the NPrinting domain service account must remain unchanged. If changed this will likely have a negative impact and unexpected behavior in your NPrinting server environment.

Example:

NP (Server/Engine) DEV - NPsvcAccount1
NP (Server/Engine) TEST - NPsvcAccount2
NP (Server/Engine) PROD - NPsvcAccount3

Or In a Single NPrinting Environment with Multiple NP Engines (Example PROD Environment with 3 NP Engines)

NP (Server/Engine) PROD - NPsvcAccountPROD1
NP (Server/Engine) PROD - NPsvcAccountPROD2
NP (Server/Engine) PROD - NPsvcAccountPROD3
is from the same domain that the NPrinting Server is a member of.
has access to all network resources where NPrinting related files are located if for example output, temp, qvw, report template, recipient folders are stored on the network. But please note that the use of Mapped Drives with NPrinting is not support. You must you UNC network paths if you must access network resources with NPrinting. ie: \\servername\sharename\nprinting\templates is a valid UNC shared path.
- Mapped drive such as Z:NPrinting\Templates is not supported.

Note: NPrinting does not support the use of multiple domain environments. Specifically, the NPrinting service account used to run the NPrinting server service must be a user account that is in the same domain that the NPrinting server is a member of. The error in Figure 1.3 below may result when an external domain user account is used to install NPrinting with.

2. Manually assign a QlikView Named User CAL to the NPrinting service account and then:

Log onto the NPrinting server as the dedicated NPrinting service account (note that you may also open the QV.exe found in "c:\program files\qlikview\" as a different user)
Open the QlikView desktop and do a 'File>Open in server' to the Production QlikView server to pull down the manually assigned CAL This steps effectively licenses the QV desktop on the NPrinting server
Navigate to the QVW you wish to connect to
If you cannot view the QVW, then you need to check that you have added the NP service account to the:
- Local administrators group on the NP server
- QlikView Administrators group on the QlikView server(s)
- If you have QlikView Publisher, publish the QVW to the NP domain user service account so that the QVW can be access using "File>Open in Server" while logged onto the NPrinting server/engine computer as the NPrinting server/engine service account.

If using a QlikView desktop CAL rather than a CAL from the QMC

Log on to the NP server
Open the QlikView desktop
Go to settings/user preferences/license tab
Click 'Change' to apply the license key and control number

Figure 1.1 Configure Desktop License

If making QVP connections from NPrinting, please ensure the correct permissions have been applied to the NP server service account via report distribution task in the QMC as shown below in order to allow the NP service account to make QVP connections.

Figure 1.2 Configure/Manually Assign a Named CAL for the NP service account (do not allow the NP service account to "dynamically" lease a Named or Session CAL)

NOTE: The NP service account, built-in Windows 'Network Service' and 'local' accounts should not have any default user rights assignments removed from it via Active Directory Group Policy. In some large network enterprises, user rights assignments are removed or changed for service account. User rights assignments must remain in their default state to ensure that Qlik NPrinting can be installed correctly and work as designed. Changing/removing any default user assignments via local group policy editor or through global network group policy management will adversely impact the installation and running of the NPrinting server environment. If policy is changed, the following similar to the one below may occur during setup and installation. See figure 1.3:

Figure 1.3

3. File access

Finally, the NP service account must have network folder and file full permission access to all network file/folder locations for which it must connect to ie: such as output file locations on the network etc. Failure to provide the NP service account with adequate computer and network permissions will result in data reload and task hanging and report generation failures. Also as a reminder if using QlikView Publisher, the QVW must be published to the NPrinting dedicated service domain user account in order to allow NPrinting Connections to that QVW on the publisher server.

NPrinting Connections with Qlik Sense

If you are running instances of NPrinting Start from June 2019 release of NPrinting and later versions

A Dedicated NPrinting Service Account is recommended for troubleshooting purposes but not required when operating June 2019 or later releases of NPrinting and connecting to Qlik Sense exclusively
There are no limitations regarding usage of token or analyzer or professional licenses with the NPrinting service account. (See attached release notes from June 2019. Resolved defect Jira issue ID: OP-8658).
See Qlik Help for details here: Qlik Sense User Account Requirements Section - Additional Qlik Sense requirements

From April 2019 and earlier versions,

A dedicated NPrinting service account should be used with Qlik Sense implementation with NPrinting
A token (original license model) or analyzer license (new license model)
Do NOT use a Professional License as this will cause connection, report preview and task failures. Use 'analyzer' license where applicable
If a QS token or analyzer license is not explicitly assigned to a dedicated NPrinting service account and the Qlik Sense service account is used to run the NPrinting services, this may cause performance problems and issues for both Qlik Sense and NPrinting. See related article: Qlik Sense April 2018 and later- Service account getting "You cannot access Qlik Sense because you have no access pass"
Therefore, a dedicated NPrinting service account should be used to mitigate issues connecting to Qlik Sense from NPrinting where the NPrinting services and Qlik Sense services are sharing the same domain user account to run their respective Windows services.

Note: Upgrading to NPrinting June 2019 or later versions removes the necessity for a dedicated user account and an assigned "Token" or "Analyzer" license for exclusively NPrinting and Qlik Sense connections.

NPrinting QlikView and Qlik Sense connections within a single NPrinting Environment.

If connecting to both QlikView and Qlik Sense and there are multiple NPrinting engines, a dedicated NPrinting service account for each engine will be necessary to ensure normal operations.

Ports (QlikView and or Qlik Sense):

Each NPrinting Engine computer must be configure to allow specific ports. For details, see the help page in the link below
https://help.qlik.com/en-US/nprinting/Content/NPrinting/DeployingQVNprinting/Ports.htm

User Rights Assignment: (Qlik Sense and QlikView)

The NPrinting Service account MUST be a member of the local administrators group
R&D has not certified any user rights assignment permissions that emulate the permissions associated with being a member of the local administrators group as specified in the user account help page. https://help.qlik.com/en-US/nprinting/Content/NPrinting/DeployingQVNprinting/User-accounts.htm

Requirements

The Qlik NPrinting Server services administrator must:

Be a member of the local Administrators group.
Have Log on as a service rights.

Related Information:

QlikView

Qlik Sense

Connecting to Qlik Sense Apps
Connecting to Qlik Sense Apps: Qlik Sense Certificate Configuration
Qlik NPrinting Service User Account Requirements - Section: Additional Qlik Sense requirements:

To connect Qlik NPrinting to Qlik Sense apps:

Add Qlik Sense server certificates to the Qlik NPrinting Engine. See: Exporting and installing Qlik Sense certificates
The same Windows user account can be used for all Qlik NPrinting Engine installations if you are only connecting to Qlik Sense.

The Windows user account that runs the Qlik NPrinting Engine service must have:

RootAdmin authorization configured in the QMC.
A domain user account that is a member of the same domain as the Qlik NPrinting server and the Qlik Sense server

Related Information:

NPrinting stops working when QlikView Leased License CAL is lost, QV Desktop License is Expired or Shared CAL in use on Separate Computers

Re: Dedicated NPrinting Server & Engine Service Account Configuration and QlikView

iliyansomlev — Tue, 14 Sep 2021 09:54:59 GMT

Thank you for the detailed article, it would be helpful if there is a video to it.

I still cannot resolve my error: X The QlikView Desktop license is valid.

I have a Named user CAL dedicated (manually assigned) to DOMAIN\qvprod user, and this user is the NPrinting Server Admin user (I log on to https://localhost:4993 with this user). The NPrinting Engine service is run with DOMAIN\qvtest user (I tried also to run it with DOMAIN\qvprod user but the same error appears). NPrinting server and engine are May 2021SR1 (21.14.4.0) version.

QV desktop (12.50.204 April 2020, SR4) is the same version as QVS and I leased the DOMAIN\qvprod license to it.

What else could be the reason for this error?

Iliyan Somlev,
Balkan Services Ltd. (Partner)

Re: Dedicated NPrinting Server & Engine Service Account Configuration and QlikView

iliyansomlev — Tue, 14 Sep 2021 10:10:21 GMT

Re: Dedicated NPrinting Server & Engine Service Account Configuration and QlikView

Frank_S — Tue, 14 Sep 2021 14:27:19 GMT

Hello @iliyansomlev

We sincerely appreciate your feedback! Thank you!

To get assistance with your specific question or questions, please post to the Qlik Community as new discussion.

In this case ask to the NPrinting Community at the link below:

NP Community

Kind regards...

Re: Dedicated NPrinting Server & Engine Service Account Configuration and QlikView

Ruggero_Piccoli — Tue, 14 Sep 2021 14:36:52 GMT

Hi Iliyan,

I suggest you to create a different post for each question in the community https://community.qlik.com/t5/Qlik-NPrinting-Discussions/bd-p/qlik-nprinting-discussions

About creating a connection to a QlikView server refer to https://help.qlik.com/en-US/nprinting/May2021/Content/NPrinting/GettingStarted/HowCreateConnections/Connect-to-QlikView-docs.htm#anchor-7. You need to insert the same path you use when opening documents on the server from QlikView Desktop, so not the full network path. You will use the Universal Naming Convention (UNC) paths, such as \\ServerName\NPrintingServer\QlikViewDocuments, when connecting to local documents stored on a network folder.

The domain user who need to have a QlikView license is the one that runs the Qlik NPrinting Engines Windows services. You can login via RDP on the computers where you installed them with that user and run QlikView Desktop to be sure the license is correctly assigned. Personal Edition is not supported.

If this will not solve, please, open the new conversations in the community.

Best Regards,

Ruggero

Re: Dedicated NPrinting Server & Engine Service Account Configuration and QlikView

iliyansomlev — Tue, 14 Sep 2021 15:58:45 GMT

Thank you for your answers.

I will open a new discussion.

BR,

Iliyan Somlev

article Dedicated NPrinting Server & Engine Service Account Configuration in Official Support Articles

Dedicated NPrinting Server & Engine Service Account Configuration

Requirements and Limitations

NPrinting Connections with QlikView

1. Create a dedicated account, which:

2. Manually assign a QlikView Named User CAL to the NPrinting service account and then:

3. File access

NPrinting Connections with Qlik Sense

NPrinting QlikView and Qlik Sense connections within a single NPrinting Environment.

Ports (QlikView and or Qlik Sense):

User Rights Assignment: (Qlik Sense and QlikView)

Related Information:

Related Information:

Re: Dedicated NPrinting Server & Engine Service Account Configuration and QlikView

Re: Dedicated NPrinting Server & Engine Service Account Configuration and QlikView

Re: Dedicated NPrinting Server & Engine Service Account Configuration and QlikView

Re: Dedicated NPrinting Server & Engine Service Account Configuration and QlikView

Re: Dedicated NPrinting Server & Engine Service Account Configuration and QlikView