Changing service account on 3.1 SYNCHRONIZED persistence

[michaeldburt]

Currently, the environment is running Qlik Sense 3.1 SR5, on synchronized persistence.  Also, the services are being run by the Local System account.

In attempting to upgrade to a later version and Shared Persistence, the installer prompts that the services cannot be run under Local System.

I cannot find anything related to 3.1 or earlier versions and changing the service account from Local System to a domain account.  The only documentation i can find relates to changing the account during the installation, before the services start.  I'm wondering if it can be done with an existing environment.

Any thoughts/suggestions?

Thanks!

[Levi_Turner · Accepted solution]

I'd strongly suggest an upgrade to something released after 2016 😄

This is going to be from memory since it has been a while since I used 3.x and much less synchronized persistence. I'll chop up the instructions from https://support.qlik.com/articles/000049699 and remove the shared persistence stuff. Again, it'll be from memory.

• Stop all Qlik Sense services
• Ensure permissions on the Program Files path (this should be provided by Local Administrator rights):
  • Installation path (default: C:\Program Files\Qlik)
  • Persistent data store: C:\ProgramData\Qlik
• Ensure access to the certificates used by Qlik Sense
  • Start > MMC > File > Add/Remove Snap-In > Certificates > Computer Account > Finish
    • Go into Certificates (Local Computer) > Personal > Certificates
    • For the Qlik CA server certificate (under Certificates (Local Computer) > Personal > Certificates)
    • Right Click on the Server Certificate > All Tasks > Manage Private Keys > Ensure that the new service account has control
    • If using a third party certificate, do the same
• Start the Qlik Sense Repository Database
• Ensure that the AppImport folder used by Qlik Sense for staging app imports will be accessible by the new service account:
  • Obtain a precautionary database backup. See How to backup PostgreSQL database in Qlik Sense
  • Open a connection to the QSR database:
  • Open a Command Prompt
  • C:\"Program Files"\Qlik\Sense\Repository\PostgreSQL\9.3\bin\psql.exe -h localhost -p 4432 -U postgres -d QSR -e
  • Note: If Qlik Sense is installed in another location, then the above path will need to be adjusted
• Type in \x to enable extended mode on the terminal
  • SELECT "AppImportFolder" FROM "RepositoryServiceSettings";
  • If this path points to a user's profile (e.g. the older service account profile path) or other path which the new service account will not have access to, then run this style of command to update reference:
    • UPDATE "public"."RepositoryServiceSettings" SET "AppImportFolder"='C:\<newPath>' WHERE "AppImportFolder"='C:\Users\<old Path>';
    • Note: I think this is right. But my memory of this style of in-the-weeds setting from 4 years ago is murky
• Ensure membership in the Local Groups that Qlik Sense requires:
  • Start > Computer Management
  • Navigate to Local Users and Groups > Local Groups
  • Add the new service account as a member of:
    • Administrators (if using this configuration option)
    • Performance Monitor Users
    • Qlik Sense Service Users
• Now for all Qlik service (except the Qlik Sense Repository Database Service) swap the account over by using the windows services control panel
• Start the remaining Qlik Sense Services
• Access the QMC to validate functionality, preferably as a previously configured RootAdmin

From there, you're going to want to change the account / password used by the data connections which start with qrs (I believe that's the old format, it's now monitor_apps...).

On Shared Persistence builds, you need to do explicit stuff to handle certificate regeneration but I don't recall that being needed on Synchronized Persistence.

Hope that helps