Troubleshooting
Problem
Attempts to start the cqintsvr11.exe process result in "cleartool: Error: Access is denied." when you run an IBM Rational ClearCase cleartool command from a Windows service.
Symptom
When you run a cleartool command that needs to connect to IBM Rational ClearQuest.
For example, the following command works when you logged in to a Windows session.
cleartool lsact -l <activity>@<pvob>
If you logout and run the same command from a Windows service under the same account, you fail to login to ClearQuest.
M:\>cleartool lsact -l <activity>@<pvob>
activity "<activity>"
2012-12-03T15:56:33+01:00 by UserA
"Created automatically as a result of 'Work On' action in ClearQuest"
owner: UserA
group: GroupA
stream: <stream>@<pvob>
title: myActivity
change set versions:
<file1>@@<branch>\28
clearquest record id: db_record_XXX
cleartool: Error: Access is denied.
cleartool: Error: Unable to logon to ClearQuest user database "DB1".
cleartool: Error: Unable to logon to ClearQuest user database "DB1".
cleartool: Error: There are no credentials registered for database DB1. Use 'crmregister add -database <cq-database-name> -connection <cq-connection-name> -user <cq-username> [-password <cq-password>]' to set these via the ClearCase command line interface.
Cause
The account used to run the Windows service does not have enough permission to start the SQUID integration process.
Environment
You run the ClearQuest UCM integration scripts on Windows from a scheduler or a continious integration tool like Jenkins or Hudson.
Diagnosing The Problem
Within the interactive session, a procmon log shows that cleartool was able to start the integration process (cqintsvr11.exe).
54602 13:45:04,2334491 cleartool.exe 8056 CreateFile C:\Program Files\IBM\RationalSDLC\ClearQuest\cqintsvr11.exe SUCCESS
54607 13:45:04,2336060 cleartool.exe 8056 ReadFile C:\Program Files\IBM\RationalSDLC\ClearQuest\cqintsvr11.exe SUCCESS
However these entries do not exist in a procmon log from a non-interactive session (Windows service). Moreover the event viewer's system log shows many error 10016.
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {YYYY} to the user UserA SID (XXXX).
This security permission can be modified using the Component Services administrative tool.
Resolving The Problem
Consider the following steps.
- Start the Component Services administrative tool under Control Panel > Administrative Tools.
- Double-click on Component Services.
- Right-click on My Computer and click Properties.
- Click COM Security tab.
- Click on Edit Default under Access Permissions and Launch and Activation Permissions.
- Add the affected account (used for the Windows service) to the list of users and grant the account full permissions.
Was this topic helpful?
Document Information
Modified date:
16 June 2018
UID
swg21621749