nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Impersonation failure on iwpt_compile.ipl

RonaldV

ts731 on win2k8

When a user regenerates a file through the ts-gui an error is shown. In the iwtrace.log it says:

[PHP]Error: Impersonation failure user= {user name}; argcount=13; errCode=1385 .......[/PHP]

This ONLY happens for user with a domain-account. If we logon with a server-local account is works as normal.

We have applied the guidelines from kb-46480 "User Rights Required for TeamSite Impersonation User (TSIMP)" and added TSIMP-* to the Administrator group temporary but this does not solve the issue.

Then I went ahead and set impersonate="false" in iwutild.cfg; this solves the problem but bypassed the impersonation.

How to solve this properly?

Find more posts tagged with

Comments

RonaldV

One more question: why has Iwov added iwpt_compile to the impersonation? Is this just for non-os-users to use tpl-templates?

nipper

One more question: why has Iwov added iwpt_compile to the impersonation? Is this just for non-os-users to use tpl-templates?

Did not know they had, but that would seem to be a reasonable approach.

Does that user have log on locally permissions ?

RonaldV

Does that user have log on locally permissions ?

Which user? The domain-user or the TSIMP-* user?

ISCBorisB

Which user? The domain-user or the TSIMP-* user?

Domain user.

"impersonation" actually means Shell's (or another process with credentials to run privileged commands)
ability to spawn a process with the Effective UID of the User it impersonates. In Windows, it is possible for
the Users that are either local OS Users or ADS/Domain Users that have "logon locally" rights in that machine.

RonaldV

Well, when I look at the facts I think that the domain users do not have 'log on locally'-privs. But i am unsure how to check this on win2k8.

ISCBorisB

Well, when I look at the facts I think that the domain users do not have 'log on locally'-privs. But i am unsure how to check this on win2k8.

You can control this settings through
Administrative Tools -> Local Security Policy -> User Rights Assignment -> Allow LogOn Locally.

You may perhaps want to test it with the single Domain User. If it works and if you decide to
follow this route, I would recommend to allow local LogOn for dedicated Group and add authorized
Domain Users to it.

There *may* exist something to configure it right from ADS Controller, I'm not sure about that.
If it does, it'll be IMO much better than the above proposal. Perhaps you can talk to your ADS
Administrators about it.

gzevin

Now I am encountering the same issue in TS 7.3.2 on 2008 server.

But I AM a local administrator there, so not sure how come I still get this ...

Anyone else has hit this before?

UPDATE.
Well... I disabled the impersonation to false and will live with it Smiley Happy

Never mind

Migrateduser

I am encountering the same issue in TS 7.3.2 on 2008 server.

I am a local administrator there.

I disabled the impersonation to false and it works fine after that.

gzevin

I am encountering the same issue in TS 7.3.2 on 2008 server.

I am a local administrator there.

I disabled the impersonation to false and it works fine after that.

I''m just curious - why have you just repeated my words? Smiley Happy