Update to 7.2, install stops cannot add SQL server login

[kadorken]

I'm sure I encountered and got around this once before, but I cannot find the clue that aided me the last time.

1) Installing VaultServer64_7_2_0_233.msi
2) Typical Install
3) Default options (Machine (IIS AppPool)
This is on Windows Server 2008 Standard, with SQL Server Express (2008)

The Install message window:

Looking for IIS Version
Configuring your new Vault Standard Installation
Requesting the IIS Process User...
Modifying VaultAppPool...
Properties: Id=NetworkService, .NET=v4.0, Mode=Integrated
Modifying VaultShadowFolderAppPool...
Properties: Id=NetworkService, .NET=v4.0, Mode=Integrated
Modifying VaultIndexAppPool...
Properties: Id=NetworkService, .NET=v4.0, Mode=Integrated
Modifying VaultNotifyAppPool...
Properties: Id=NetworkService, .NET=v4.0, Mode=Integrated
Modifying SgDavAppPool...
Properties: Id=NetworkService, .NET=v4.0, Mode=Classic
Creating Applications in IIS for web services...
VaultService application created.
Creating Applications in IIS for VaultShadowFolder web services...
VaultShadowFolder application created.
Creating Applications in IIS for Find in Files Index web services...
VaultIndexService application created.
Creating Applications in IIS for Notification web services...
VaultNotificationService application created.
Creating Applications in IIS for SdDav web services...
SgDav application created.
Creating Virtual Directories...
VaultService Virtual Directory created.
VaultShadowFolder Virtual Directory created.
VaultIndexService Virtual Directory created.
VaultNotificationService Virtual Directory created.
SgDav Virtual Directory created.
Requesting Admin user password...OK
Connecting to the SQL Server...OK
Verifying the SQL Server requirements...OK
Checking for existing databases...Found.
Asking for database's fate...Keep existing.
Upgrading the existing source control database...
This may take a long time. Do NOT stop this process!
Checking the installed database version...OK
The user, NT AUTHORITY\NETWORK SERVICE, could not be added as a SQL Server login. Please verify the windows account exists on this machine.

Note, on some database collations check the case of the user's name.
Vault Standard Setup is exiting due to a failure or cancellation. Error Code = 902

[Beth]

The last time we discussed the Network Service user with your install was resolved by in post you made: http://support.sourcegear.com/viewtopic ... 607#p54607.

Are you upgrading from a version prior to 6.0?

Is your SQL Server instance .\sqlexpress or something else? The default for specifying a SQL Express instance is .\sqlexpress.

Is NT Authority\Network Service present in the SQL Server Security logins?

[kadorken]

Beth,

No to upgrading from version prior to 6.0; current version installed (and was working) is 7.1

The default instance is SQLEXPRESS; I tried install using (local) and explicit MACHINENAME\SQLEXPRESS

Yes, NT AUthority\Network Service is already a Login on the SQL server (and was in use by 7.1 installed in January of this year)

Attempting to install either 7.1 or 7.2 now gets this error and vault is not working on this machine.

I did try to run the install as Administrator as well (although technically this shouldn't be required as the Installer is running at elevated permission anyway)

I'll check the SQL server permissions for Network Service tonite (it is an offsite customer machine) to see if that has any bearing (but I fail to see how this would be the problem during the Installation phase).

Thanks, Keith

[kadorken]

Is it possible the Installation program is 'searching' to see if the NT AUTHORITY\NETWORK SERVICE is already a login (by searching for that string in the SQL database master DB) and if not 'found' with that name, tries to add the login (which fails, because the login already exists, just not by the name exactly searched for (caseless or otherwise)).

The failure to add the login if it already exists should not be an installation error (?) IMO and the installation should recognize that and continue.

[Beth]

Did you by any chance move to a different SQL Server?

What happens during the Vault install is that it checks to see if the user exists. If the user does not exist, then it adds that user. If the user does exist, then it moves on.

I might need a closer look to see what's happening. Could you send an email to support at sourcegear.com (attn: Beth) with a link to this forum thread?

[kadorken]

No, didn't move servers. Just trying to upgrade existing server from 7.1 to 7.2, no other changes.

[Beth]

In your user's temp directory (%temp%) is a file called Vault_install.log. Could you send an email to support at sourcegear.com (attn: Beth) with a link to this forum thread and attach that log file as well?

[kadorken]

Beth, I checked the install log before I sent it to you for the clues. This lead to the following sequence of events.

Looking in the vault_install.log, I noted the following message:
Upgrading existing database user information with a new install.
Login used is: NT AUTHORITY\NETWORK SERVICE
The stored procedure to grant a Windows Login database access failed. User does not have permission to perform this action.
The user, NT AUTHORITY\NETWORK SERVICE, could not be added as a SQL Server login. Please verify the windows account exists on this machine.

Note, on some database collations check the case of the user's name.

This lead me to ADD BUILTIN\Administrators with SQL SysAdmin rights as a LOGIN on the SQL server (it wasn't already there) [Since I noted the install CustomActionExe.exe (assumed to be vaults) was running as "SYSTEM]

I also noted that 'SYSTEM' on the Sql Server did NOT have SysAdmin rights but did not change that at this time.

Reran the installation, and it completed (albeit with some warnings in vault install log; will send as separate email)

This time the installation completed 'successfully', but the web service was not started properly (Error 503 error trying to login as Vault Admin in internet explorer).

I tried IIS reset, but no change. Noted the VaultAppPool was not running.

Then checked the system event log and found the 'WAS' warning:

The identity of application pool VaultAppPool is invalid. The user name or password that is specified for the identity may be incorrect, or the user may not have batch logon rights. If the identity is not corrected, the application pool will be disabled when the application pool receives its first request. If batch logon rights are causing the problem, the identity in the IIS configuration store must be changed after rights have been granted before Windows Process

I checked the AppPool configuration and noted all the Vault AppPools were set to run as WIN2008\SYSTEM (NT AUTHORITY\SYSTEM) who did not have SysAdmin on SQL server, NOR access to the vault databases.

I put SysAdmin rights for SYSTEM on in the SQL database (login only), but no change in behavior. I remembered SYSTEM did not have user rights on the vault databases, but network service did, so...

I changed the AppPools to use Network Service instead and restarted them; that fixed the problem and now vault seems to be running.

(If I had remembered the vault_install log I would have figured this out earlier; however, documenting the steps may aid others. I am not sure WHY or how the SQL server permissions 'changed' since I installed 7.1 in January on this server; I didn't change them; perhaps a Windows update to SQL server made some 'modifications' ?)

Thanks for the help, Keith

[Beth]

Thanks for the update.

The next steps I would have tried is running an administrative command prompt and used the command msiexec /i <name of Vault MSI>. Even though you have administrative privileges, the installers still often don't run that way and can't change permissions.

I'm happy to hear you are up and running.