Shell command authority on Windows 2000

HCL Domino Domino Forum
1

I am hoping somebody can provide some pearls of wisdom here.

I have an agent running on the click of a button from a view. It uses runonserver to call a server agent.

The server agent is running a shell command to run an executable. The executable runs and connects across the network using an ODBC connection to an SQL table on an AS400. The ODBC connection is a system DSN and connects to the table successfully.

If you run the command prompt from the windows server and type in the call to the executable, the app picks up some files and generates the PDF outcome. The pdfs all contain the info they should.

If you run the command from the notes client… running the server agent, the PDF files that are generated are all blank, with a standard file size of 5kb.

I have narrowed this down to possible access issues, the windows server is logged in with the system admin user. The agent is signed with a notes user that rights to run server agents but is not an administrator of the windows server.

I am hoping that somebody has experience with windows and notes and could steer us in the right direction.

Thanks

Nic

2

Subject: Shell command authority on Windows 2000

There are a few things to look at:

  1. Does the signer of the agent have the rights to run restricted agents? Shell commands require that.

  2. Domino is running as “System”, which means that, as far as shell commands are concerned, agents have access to the same Win2K resources as “System” does. One thing that “System” does not have is any defined printers. (I have not been able to find a way of doing so.) Since most methods of creating PDFs require use of printers or pseudo-printers (Acrobat writer, PDF995, etc.), “System” cannot create PDFs. You may need a more elaborate method of creating the PDFs. There are free Java classes (Entreprenerd — The Book about iText) for doing this.

3

Subject: RE: Shell command authority on Windows 2000

Hi Glenn,

Thanks for this.

  1. It does have the rights to run restricted agents.

  2. That makes sense and explains why we have has so many issues.

We decided to work around this as time was short. To combat the issue the code was changed in the server agent to generate and populate a .bat file on the Windows server.

We then set up a scheduled task on the server to pick up a .bat file every minute which called the generated .bat file and processed it,then deleted it.

As you can sign the scheduled tasks with server administrators this was successful.

Again, Thanks for the feedback.