Access is denied when running Rational ClearQuest UCM integration from non-interactive Windows session

When you run a cleartool command that needs to connect to IBM Rational ClearQuest.

For example, the following command works when you logged in to a Windows session.

cleartool lsact -l <activity>@<pvob>

If you logout and run the same command from a Windows service under the same account, you fail to login to ClearQuest.

M:\>cleartool lsact -l <activity>@<pvob>
activity "<activity>"
2012-12-03T15:56:33+01:00 by UserA
  "Created automatically as a result of 'Work On' action in ClearQuest"
  owner: UserA
  group: GroupA
  stream: <stream>@<pvob>
  title: myActivity
  change set versions:
    <file1>@@<branch>\28
  clearquest record id: db_record_XXX
cleartool: Error: Access is denied.
cleartool: Error: Unable to logon to ClearQuest user database "DB1".
cleartool: Error: Unable to logon to ClearQuest user database "DB1".
cleartool: Error: There are no credentials registered for database DB1.  Use 'crmregister add -database <cq-database-name> -connection <cq-connection-name> -user <cq-username> [-password <cq-password>]' to set these via the ClearCase command line interface.

The account used to run the Windows service does not have enough permission to start the SQUID integration process.

You run the ClearQuest UCM integration scripts on Windows from a scheduler or a continious integration tool like Jenkins or Hudson.

Within the interactive session, a procmon log shows that cleartool was able to start the integration process (cqintsvr11.exe).

54602   13:45:04,2334491   cleartool.exe   8056   CreateFile   C:\Program Files\IBM\RationalSDLC\ClearQuest\cqintsvr11.exe   SUCCESS
54607   13:45:04,2336060   cleartool.exe   8056   ReadFile   C:\Program Files\IBM\RationalSDLC\ClearQuest\cqintsvr11.exe   SUCCESS

However these entries do not exist in a procmon log from a non-interactive session (Windows service). Moreover the event viewer's system log shows many error 10016.


The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {YYYY}  to the user UserA SID (XXXX).  
This security permission can be modified using the Component Services administrative tool.

Consider the following steps.

1. Start the Component Services administrative tool under Control Panel > Administrative Tools.
   
   
2. Double-click on Component Services.
   
   
3. Right-click on My Computer and click Properties.
   
   
   
   
   
   
   
   
   
   
4. Click COM Security tab.
   
   
5. Click on Edit Default under Access Permissions and Launch and Activation Permissions.
   
   
   
   
   
   
   
   
6. Add the affected account (used for the Windows service) to the list of users and grant the account full permissions.