DataStage administration

[JPalatianos]

Hi,
I have installed DataStage on a Windows 2003 server and have been developing for that past couple of Months. Even thought I had our security folks create Groups to define in the Permisions Tab, I have never implemented that yet. I still have the "everyone" group set to DataStage Developer. This morning admin rights was taken away from me(my ID) on the server and I can no longer log into DataStage(designer, manager etc.).

My question is what level of access do the groups need to the server in order to access DataStage.......I thought I would still be able to access DataStage since the Everyone/DataStage Developer permissions was still there but now I get a log in error trying to launch designer.

Thanks - - John

[loveojha2]

I thought I would still be able to access DataStage since the Everyone/DataStage Developer permissions was still there but now I get a log in error trying to launch designer.

Even I think so, you should be able to login to the server since it is granted to everyone.

Are you using omit option while logging in?(but still it should connect, me thinks)

I guess you are able to ping the server since you are getting the login failure error only.
What exact error message are you getting?
Windows 2003 should behave pretty much similar to Window 2000.

Can you login through the same machine (the server)?

[meena]

Hi John,
Can you say what login error you are getting.......

[JPalatianos]

My company does things slowly......I was granted temporary admin rights to the machine this morning for 48 hours and no more troubles logging in.
If(when) the login problem happens again at that point I will attach the error message.
Thank you both!

[JPalatianos]

I have added another user to a group with the "DataStage Developer" role. They have no admin rights to the server(I do have admin rights). I am able to log in to designer but they get the same error I received yesterday.....

Failed to connect to host: NJROS1BVA0301, project: Voba
(User name and/or password incorrect (80011))[/img]

[meena]

Hi John...
Do a search in the forum based on '80011'. I think you can come out of your issue .......

I have added another user to a group with the "DataStage Developer" role. They have no admin rights to the server(I do have admin rights). I am able to log in to designer but they get the same error I received yesterday.....

Failed to connect to host: NJROS1BVA0301, project: Voba
(User name and/or password incorrect (80011))[/img]

[JPalatianos]

Seems like it is security policy specific to Windows 2003 Servers. This was not part of the administartion guide, IBM technical support just send it to me and it solved the problem. Hope it can help someone else.



Instructions to set up permissions & groups for Windows 2003 Servers
--------------------------------------------------------------------
Windows 2003 Server uses different security policies to other Windows
platforms. In order to allow access to a DataStage server on this platform,
some additional setup steps are required, as outlined below.

NOTE: Install DataStage first then follow the steps below.

You must be logged on as an Administrator to be able to set the following
access & permissions. Two sets of instructions are given below, dependent on
whether the server is a domain controller.

A) Non-Domain Controller Windows 2003 Server:

1. Allow Log on Locally

In Explorer, select Control Panel, Administrative Tools.
Start Local Security Policy.
Select Local Policies, User Rights Assignment.
Select Allow Log on Locally.
Select Action, Properties from menu.
Press Add User or Group button.
Press Locations button, select your local machine,
Press OK button.
Press Advanced button.
Press Find Now button.
Select Authenticated Users, Press OK Button.
Press OK button.
Press OK button.
Exit Local Security Policy

2. Create Group

In Explorer, select Control Panel, Administrative Tools.
Start Computer Management.
Select System Tools, Local Users & Groups.
Select Groups.
Select Action, New Group from the menu.
Enter a name for the group e.g. DataStage Users.
Press Create button.
Press Close button.

3. Add Users

In Explorer, select Control Panel, Administrative Tools.
Start Computer Management.
Select System Tools, Local Users & Groups.
Select Groups, in tree.
Select required group e.g. DataStage Users.
Select Action, Add To Group from menu.
Press Add button.
Press Locations button.
Select your local machine name, Press OK button.
Press Advanced button.
Press Find Now button.
Select users to be added to the group, at least
including Authenticated Users, Press OK Button.
Press OK button.
Press OK button.
Close Computer Management.

4. Set Permissions on DataStage Folder

In Explorer, locate DataStage Folder e.g. c:\Ascential\DataStage.
Select File, Properties from menu.
Select Security Tab, Press Add button.
Press Locations button.
Select your local machine name, Press OK button.
Press Advanced button.
Press Find Now button.
Select your group name e.g. DataStage Users.
Press OK Button.
Press OK Button.
Select your group.
Check the Modify & Write checkboxes in the Allow column.
Press OK button.


B) Domain Controller Windows 2003 Server:

1. Allow Log on Locally

In Explorer, select Control Panel, Administrative Tools.
Start Domain Security Policy.
Select Local Policies, User Rights Assignment.
Select Allow Log on Locally.
Select Action, Properties from menu.
Press Add User or Group button.
Press Browse button.
Press Advanced button.
Press Find Now button.
Select Authenticated Users, Press OK Button.
Press OK button.
Press OK button.
Press OK button.
Exit Domain Security Policy

Repeat these steps for the Domain Controller Security Policy application.

2. Create Group

Note that it is not possible to add the Built-in "Authenticated Users"
group to a group we create in steps 2 & 3, so you may prefer to skip
to step 4 and use the "Authenticated Users" group directly.

In Explorer, select Control Panel, Administrative Tools.
Start Active Directory and Computers.
Select Users in the current domain.
Select Action, New, group from the menu.
Enter a name for the group e.g. DataStage Users.
Leave the Group scope as Global, Group type as Security.
Press OK button.

3. Add Users

In Explorer, select Control Panel, Administrative Tools.
Start Active Directory and Computers.
Select Users in the current domain.
Select required group e.g. DataStage Users.
Select Action, Properties from menu.
Select Members Tab.
Press Add button.
Press Advanced button, press Find Now button.
Select users to add to the group (Authenticated Users not available).
Press OK button.
Press OK button.
Press OK button.
Close application.

4. Set Permissions on DataStage Folder

In Explorer, locate DataStage Folder e.g. c:\Ascential\DataStage.
Select File, Properties from menu.
Select Security Tab, Press Add button.
Press Advanced button.
Press Find Now button.
Select your group name e.g. DataStage Users or Authenticated Users.
Press OK Button.
Press OK Button.
Select your group.
Check the Modify & Write checkboxes in the Allow column.
Press OK button.