Qlik Community

Ask a Question

Knowledge

Search or browse our knowledge base to find answers to your questions ranging from account questions to troubleshooting error messages. The content is curated and updated by our global Support team

Announcements
Talk to Experts Tuesday: Live chat Aug. 24th 10 AM ET: Bring your Qlik Gold Client questions REGISTER TODAY

Qlik Sense Service Account requirements and how to change the account

Juli_K
Support
Support

Qlik Sense Service Account requirements and how to change the account

The Windows User account used to run the Qlik Sense Services can be changed with no issues as long as some preparations have been made.

Key Considerations: What the account needs access to.

 

  1. Certificates
    • Access to the certificate(s) for the site
  2. Files and file shares
    • Access to the installation path for Qlik Sense
    • Access to %ProgramData%
    • Access to the Service Cluster share
  3. Access to external systems as data sources, e.g.
    • Databases
    • UNC shares to QVDs, CSVs, etc

This article will outline how to successfully change the service account running Qlik Sense.

As a note, this guide is intended to be exhaustive. Many of the file level permissions would ordinarily be inherited from membership to the Local Administrators group. For information on non-Administrative accounts running Qlik Sense Services see Changing the user account type to run the Qlik Sense services on an existing site.

Environment:

  • Qlik Sense Enterprise on Windows all versions

 

 

 

Prep work:

 

Record the Share Path. Navigate in the Qlik Management Console (QMC) to Service Cluster and record the Root Folder.

 
changeQSserviceaccount01.png

 

Changing Qlik Sense dependencies:

 

  • Stop all Qlik Sense services
  • Ensure permissions on the Program Files path (this should be provided by Local Administrator rights):
    • Navigate to the installation path (default: C:\Program Files\Qlik)
    • Select the Sense folder > Right Click > Properties > Security > Edit > Add
      • Lookup the new service account
      • Ensure that the account has Full control over this folder
  • Ensure permissions on the %ProgramData% path (this should be provided by Local Administrator rights):
    • Navigate to the installation path (default: C:\ProgramData\Qlik)
    • Select the Sense folder > Right Click > Properties > Security > Edit > Add
      • Lookup the new service account
      • Ensure that the account has Full control over this folder
  • Ensure access to the certificates used by Qlik Sense
    • Start > MMC > File > Add/Remove Snap-In > Certificates > Computer Account > Finish
      • Go into Certificates (Local Computer) > Personal > Certificates
      • For the Qlik CA server certificate (under Certificates (Local Computer) > Personal > Certificates)
        • Right Click on the Server Certificate > All Tasks > Manage Private Keys > Ensure that the new service account has control
      • If using a third party certificate, do the same
  • Ensure access to the Service Cluster path used by Qlik Sense
    • Start > Computer Management > Shared Folders > Shares > Select the Share path
    • Right click on the Share Path > Properties > Share Permissions > Add the new service account to have full control
    • Open Windows File Explorer and navigate to the folder (e.g. C:\Share) > Right click on the folder > Security > Edit > Add the new service account to have full control
  • Ensure membership in the Local Groups that Qlik Sense requires:
    • Start > Computer Management
    • Navigate to Local Users and Groups > Local Groups
    • Add the new service account as a member of:
      • Administrators (if using this configuration option)
      • Performance Monitor Users
      • Qlik Sense Service Users

 

Change the service account:

 

  • Now for all Qlik service (except the Qlik Sense Repository Database Service) swap the account over by using the Windows services control panel
  • Start the remaining Qlik Sense Services
  • Access the QMC to validate functionality, preferably as a previously configured RootAdmin
  • Access the Data Connections section of the QMC
  • Toggle the User ID field and change the data connections used by the License and Operations Monitor apps to use the new user ID and password:
 
changeQSserviceaccount02.png

  • Add the RootAdmin role to the new service account*
    • QMC > Users
    • Filter on the new UserID > Edit
    • Add RootAdmin role

*If this account is not existing yet in Qlik Sense, you would need to try to connect to the Hub/QMC with this new account first, in order to be able to see it in QMC>Users.

  • Execute the License Monitor reload task
  • Inspect the configured User Directory Connectors and change the User ID and password combination if previously configured.

 

External Dependencies:

 

  • Go into the QMC > Data Connections section and inspect all Folder data connections to determine all network shares that the service account needs access to. Either change them yourself or alert the necessary teams to provide both Share and NT level access to these shares.
  • Inspect all Data Connections and ensure that none use the old Service account and password. Follow up with necessary teams to provide access to data sources which used the old credentials.

 

 

Labels (1)
Version history
Revision #:
8 of 8
Last update:
‎2021-06-02 09:43 AM
Updated by: