TDM Server MAnager 2017 cannot edit security settings

[Chris_P_SD]

Does anyone know why TDM Server 2017 creates a "BUILTIN/BUILTIN" user in its security settings and then won't allow you to remove it?

I just noticed this yesterday while trying to understand why a few of our users are able to execute queries through TDM Server 2017, but they are unable to load query results.  It seems this is related to the Windows ACL's that TDM Server uses to apply security to certain search areas.

[Sil.VI]

Hi Chris P,

I have looked a bit on this Builtin/Builtin option and it seems as if this is realted to selecting the Local System option for the server, which is not recommended because it doesn't has access to network resources. Did you selected this option while setting your server?

Regards,

[Chris_P_SD]

Hello Mr. Jimenez,

No, I believe I used my own network credentials when setting up the TDM Server:

Thank you,

Chris

[Brad_Turpin]

Hi Chris,

I spoke to R&D, and they asked me to relay to you the following questions:

• Might your IT have recently removed this "BUILTIN\BUILTIN" account?
• Can you please tell us exactly how you added the security rules (looking for step by step instructions to reproduce)?
• Could you try creating a new DataFinder instance and see if you see this account appear again?

Thanks,

Brad Trupin

DIAdem Product Support Engineer

National Instruments

[Chris_P_SD]

Hi Brad,

The  "BUILTIN\BUILTIN" account seems to get created by DataFinder when I RDP into the DataFinder computer. 

The security rules were assigned by first assigning permission on the NAS that hosts the two DataFinder search areas (shared folder).  After assigning permissions on the NAS, the same shared permissions were imported on TDM Server 2017.

This generally works as expected...  until it doesn't.

There is a bit of a debugging process each time a new DIAdem client is set up to use the DataFinder.  Often, but not always, the folder permissions on TDM Server must be removed and then reassigned to get access for the new user.

Usually the TDM Server Manager throws errors when trying to do this, but then does it anyway.

[Chris_P_SD]

Forgot to mention I did try to create a second DataFinder to test security, but was disallowed by licensing:

[Chris_P_SD]

Just figured out this issue.  It was file "security settings" once again.

For some reason, the file permissions in DataFinder were not allowing DIAdem clients to connect to the DataFinder.  After deleting all security settings, then reimporting them from the file system and checking deleting "garbage" permissions that the import brought in, DataFinder was able to accept the security settings and clients were once again able to connect from DIAdem.

I'm not sure if this is an issue with Windows or TDM Server 2017, but somehow importing the security settings brings in gargage settings (possibly created by the Synology NAS?) that can't actually be applied because there are duplicate instances of these in the list.