Procedure to Change Content Server Installation Owner

I recently had the pleasure(?) of changing the installation owner for a client’s production Documentum environment (v6.6/Win2008 x64/SQL Server). Here are the steps I used, though your mileage may vary depending upon numerous factors.  Note that [text in brackets] denotes variable names you will need to supply for your environment.

  1. Obtain [new install owner] credentials. Validate that the new account has the following privileges:
    • Act as part of the operating system,
    • Create a token object,
    • Increase quotas,
    • Log in as a service,
    • Log in locally,
    • Replace a process‑level token.
  2. Login to DA as dmadmin.  For the [repository] and the [global registry repo]:
    • Click Storage in the navigation tree and select the storage_01 object.
    • Right-click the storage_01 object and select Properties.
    • Note the File System Path.
    • Log out.
  3. Log onto Documentum server as [old install owner].
  4. Stop all Documentum services:
    • Documentum Docbroker Service,
    • Documentum Docbase Service [repository name],
    • Documentum Docbase Service [global registry repo] if necessary,
    • Documentum Java Method Server.
  5. Change the logon user for each Documentum process listed in step 4 to the [new install owner].
    • Open the Services control panel.
    • Right-click the service, and choose Properties.
    • Switch to the Log On tab.
    • Enter new installation owner credentials.
    • Click Apply, and then OK.
  6. Edit the install_owner parameter in the %DOCUMENTUM%\dba\config\[repository name]\server.ini file to reference the new installation owner.

    install_owner = [new install owner]

  7. Repeat step 6 for the [global registry repo] if necessary.
  8. Change permissions on the %DOCUMENTUM% directory and all subdirectories.
    • In Windows Explorer, select the %DOCUMENTUM% directory.
    • Right-click and choose Properties.
    • Switch to Owner tab.
    • Click the ‘Other Users or Groups’ button, add the [new install owner].  Click OK.
    • Select [new install owner], check ‘Replace owner on subcontainers and objects’, and click the Apply button.
    • Switch to the Security tab.
    • Click the Advanced button.
    • Click the Add button, add the [new install owner] and give it Full Control permissions. Click OK.
    • On the Permissions tab, select the [new install owner], check the ‘Replace permission entries on all child objects with entries shown here that apply to child objects’ checkbox, and click the Apply button.
    • Click Yes on the warning dialog.
    • The system will update the security definitions for all files and folders in the %DOCUMENTUM% directory. This could take while.
    • Click OK and close the Properties dialog.
  9. Repeat step 8 for the File System Paths noted in step 2 if they are not included in the %DOCUMENTUM% folder structure.
  10. Update Registry entries.
    • Open the Registry using RegEdit.
    • HKEY_LOCAL_MACHINE\SOFTWARE\Win6432Node\Documentum\Server\6.6
      • Change the value of DM_DMADMIN_USER to [new install owner].
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\[repository name]
      • Change the value of ImagePath to contain –install_owner [new install owner].
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\[global registry repo]
      • Change the value of ImagePath to contain –install_owner [new install owner].
  11. Change security settings on each of the following Registry keys.
    • For each key under HKEY_LOCAL_MACHINE\SOFTWARE\Wind6432Node\Documentum\DOCBASES
      • Right-click the repository name and choose Permissions….
      • Click the Add button and add [new install owner] to the list of users.
      • Select [new install owner] and give it Full Control.
      • Click the Apply button, and then OK.
    • For key HKEY_LOCAL_MACHINE\SOFTWARE\Documentum\Server\6.6
      • Right-click the repository name and choose Permissions….
      • Click the Add button and add [new install owner] to the list of users.
      • Select [new install owner] and give it Full Control.
      • Click the Apply button, and then OK.
    • For key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\Documentum
      • Right-click the repository name and choose Permissions….
      • Click the Add button and add [new install owner] to the list of users.
      • Select [new install owner] and give it Full Control.
      • Click the Apply button, and then OK.
  12. Open database management tool and login as the database administrator.
  13. Run the following SQL query to update the install owner attributes of the server config objects.
    • UPDATE [repository name].[dbo].dm_server_config_s SET r_install_owner = '[new install owner]'
    • UPDATE [global repository repo].[dbo].dm_server_config_s SET r_install_owner = '[new install owner]'
  14. Restart the Documentum services stopped in step 4.
  15. Log into DA as the [new install owner].
    • Ensure the [new install owner] account privileges are identical to [old install owner] account.
    • Select [old install owner] and choose Tools – Reassign User.
    • Select the [new install owner]
    • Configure the job to run Now, to Unlock All objects, and to Save changes and report results.
    • Click OK. This could take a while.
    • Note that this process will remove the [old install owner] account from the Docbase.
    • To monitor the progress of the reassignments, enter the following query in the DQL Editor, and re-run it often. When the result is zero (0), the reassignment is complete.

      select count(*)from dm_sysobject where owner_name = '[old install owner]'

  16. Run the State of the Docbase report and review for anomalies and/or errors.
  17. Run the Consistency Checker and review for anomalies and/or errors. You may have to compare it with a previous report to determine if any reported inconsistencies are due to the changes you made, or were pre-existing.
  18. Publish the Data Dictionary and check for errors.
  19. From DA, checkout/checkin files.
Advertisements

About Scott
I have been implementing Documentum solutions since 1997. In 2005, I published a book about developing Documentum solutions for the Documentum Desktop Client (ISBN 0595339689). In 2010, I began this blog as a record of interesting and (hopefully) helpful bits of information related to Documentum, and as a creative outlet.

8 Responses to Procedure to Change Content Server Installation Owner

  1. Per Zester says:

    Hi Scott.
    Excellent explanation, Great stuff!!.
    I reckon you assume the new_install_owner account is already created as superuser in the repositories before you start. I usually recommend to modify the GR before all others, but that’s just me nitpickin’.
    Also remember to verify/modify if any peripheral services – say ADTS etc – rely on the IO account.
    Last but not least, remember to disable the old_install_owner account at AD/Repo level for security reasons..

    Thanks, Per

    Like

    • Scott says:

      Also great recommendations, thanks for sharing. This change was on a very simple environmnet that didn’t include any peripheral products, so I didn’t include any advice on changing those environments. Thanks for the reminder that there could be more changes involved than just those that I covered. Interestingly, I did not have to create the new_install_owner account in DA. It was automatcially created when the Docbase was started. However, I did have to login and give it more privileges. The Reassign job deleted the old_install_owner at the completion of the reassignment job so it was not necessary to disable it.

      Like

  2. Srinivas A says:

    after starting the documentum services, unable to login to DA or Webtop, facing the below error:
    type Exception report

    message

    description The server encountered an internal error () that prevented it from fulfilling this request.

    exception

    org.apache.jasper.JasperException: Unable to compile class for JSP:

    An error occurred at line: 6 in the generated java file
    Only a type can be imported. com.documentum.web.form.IParams resolves to a package

    An error occurred at line: 7 in the generated java file
    Only a type can be imported. com.documentum.web.form.Trace resolves to a package

    An error occurred at line: 8 in the generated java file
    Only a type can be imported. com.documentum.web.util.SafeHTMLString resolves to a package

    An error occurred at line: 9 in the generated java file
    Only a type can be imported. com.documentum.web.form.Form resolves to a package

    An error occurred at line: 11 in the jsp file: /wdk/redirect.jsp
    IParams.FRESH_CLIENT cannot be resolved to a type
    8:
    9: <%
    10: String strUrl = null;
    11: String strClientId = request.getParameter(IParams.FRESH_CLIENT);
    12: if (strClientId == null || strClientId.length() == 0 )
    13: {
    14: strUrl = request.getParameter(IParams.URL);

    Like

    • Scott says:

      Seems like a app server problem. Have you deleted the app server cache and working directories and restarted it? Did you make any changes to the app server (version of Java or tomcat)? Did you patch DA or Wetop?

      Like

      • Srinivas A says:

        Yes we have cleared the cache and working directories and restarted the app server. before the change we were able to login to DA and webtop. and we did not made any changes to App server after that.
        I tried to access DA and Webtop both giving mee same error.

        Thank you for your response.

        Like

  3. Srinivas A says:

    Hi Scott,

    were you able to login to DA and Webtop after performing these changes?

    We have experimented these stes in Sandbox environment, and facing the issues for the corresponding DA and Webtop.
    Well i tried to add this sandbox repository from working DA of Dev environment by adding more repositories, and was able to login to sandbox and run couple of DQL queries too. able to checkout and checkin document.

    do you feel if there is any classpath or environment setting needs to be changes during the steps you mentioned.

    any suggestions and ideas will be really helpfull, thank you

    regards,
    Srinivas A

    Like

    • Scott says:

      Srinivas,
      Sorry to hear you are still experiencing problems with your environment. I did not experience anything like this when I changed the owner in my environment. Looking at your stack trace again, the error, seems to me, to be happening before DA or Webtop even try to connect to the repo. My gut says this is a config problem with the app server, especially since you were able to connect and login from a different DA. Have you tried redeploying DA?

      Is your repo also the global registry? Is the install owner also the global registry user? Did you change ownership of the global registry also?

      Like

      • Srinivas A says:

        Scott,

        Yes, we have 2 repo’s global and xyz1, i have changed the ownership in both the repo’s.
        however, the “dfc.globalregistry.username” is different user in dfc.properties, not the owner.

        I haven’t tried redeploying DA, will do it if no other options work.

        Like

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: