Errors while installing with iceserviceinstall on Windows MUI systems

aikson

Hello,

we discovered an error while installing our services on Windows Server systems. Normally everything works fine, but on some servers we got this error message:

C:\>iceserviceinstall.exe icegridregistry "C:\SANDPIPER1\InfrastructureServiceLocator\config.registry" 
--AutoStart=1 --Description="Infrastructure Service Locator" 
--DisplayName="Infrastructure ServiceLocator" --ObjectName="SYSTEM" 
Error: Could not retrieve Security ID for NT-AUTORITÄT\SYSTEM: No mapping between 
account names and security IDs was carried out.
Press any key to continue . . .

I tried to trace down the reason, why some servers are working correctly and on others are breaking under certain conditions. After several tries I came to the conclusion, it is a problem of destinct users on our systems. With this in mind I was browsing around and came across this thread in your help forum, which finally tips me in the right direction:

http://www.zeroc.com/forums/help-center/4004-icegridnode-windows-service-2.html from reply #17 on.

So I narrowed it down to the MUI installation of some of our servers. The GetEffectiveRightsFromAcl function in the iceserviceinstall code seems to break if multiple language packs are installed and the current installing user was on a other language then the default system one. In our case it was a problem between German, English and French. If the user had the primary language turned to german everything worked fine. If the language was switched to English or French the iceserviceinstall failed with the above mentioned error regardless of any tried --ObjectName or even without it.

After getting the grip of the cause, I discovered this article from Microsoft, which seems to specify the reasons pretty well.
GetEffectiveRightsFromAcl has problems with Language Packs and Universal Groups
They also provided an solution, GetEffectiveRightsFromAcl function (Windows)
but my C++ skills are a little bit to rusty, as I would try to patch the iceserviceinstall application by myself.

Is this a known bug from the iceserviceinstall application. Could I prevent it somehow? Or could you give me a hint how I could patch the sources with the new API functions mentioned in the solution from Microsoft?

Best regards
Dirk Holzapfel

bernard

Hi Dirk,

Thank you for reporting this issue and researching its origin. This was not a known problem.

We should indeed replace the call to GetEffectiveRightFromAcl by a call to AuthzAccessCheck as Microsoft described in the latest reference page for GetEffectiveRightFromAcl, and also test iceserviceinstall in a multi-language environment like yours. We will try to include this fix in the next Ice release.

In the meantime, you could run iceserviceinstall from a user with the system-default language (probably not always practical). Alternatively, you could configure your icegridregistry, icegridnode and glacier2 services manually - without iceserviceinstall but with Microsoft utilities - as described at Manually Installing a Service - Ice 3.5 - ZeroC.

Best regards,
Bernard

aikson

Hi Bernard,

Thank you for your quick response. It is good to know there will be a patch/fix for the problem in the next release. If you are done and needing a beta tester, we would be happy to test your solution.

It is also good to know, there is a second solution (manuall installation) for the problem. For know we discovered this only on our internal servers, so we will stick to the quick and dirty solution and change the primary languages of the administration users to the system-default.

Best regards
Dirk

xdm

Hi Dirk,

I trying to reproduce that problem without success, here is what i have tested.

I installed several language packs from Windows Update, then in control panel "Region and Language" I change the display language to non English, restart the session and test iceserviceinstall with the new display language, and it worked.

What Windows version were you using when it failed?

Is the "display language" setting what trigger the issue, or is it other language settings?

aikson

Hi xdm,

we tested on a Windows Server 2012R2, but I think every post-Vista MUI Windows will trigger the problem. But switching the "display language" is probably not enough. We changed the "primary language" for a user (see attached pictures) to "not English" respectivly "not installation language", because our ISO installation file was a German Windows.

Unfortunately we discovered a similar problem while installing on a different non MUI system. Our test installation failed with this error.

IceServiceInstaller: SID: S-1-5-19; Full name: NT Authority\LocalService
IceServiceInstaller: Granted access on C:\ProgramData\A+W\Sandpiper1\BasicDataServices\db to NT Authority\LocalService
Error: Could not retrieve effective rights for NT Authority\LocalService on MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib: A global group cannot have a cross-domain member.

We did not pursue this problem until now, because we are hoping we could fix it with another installation user, but probably it has something to do with the same API functions.

Best regards
Dirk