This article discusses several approaches to updating the Documentum installation owner of a 5.2 Windows 2000 Docbase.
Blue Fish Development Group
701 Brazos St. #700
Austin, TX 78701
(512) 469-9300
This article discusses several approaches to updating the Documentum installation owner of a 5.2 Windows 2000 Docbase.
When initially installing Documentum, the installation owner is set to the logged-in user that performs the Documentum installation. It is preferable to install Documentum and never change the installation owner. However, sometimes company policy dictates that the original installation must be changed. Reasons for the change may be that the user name does not conform to a new naming policy or that originally the user was not a domain user but now should be.
Changing the installation owner involves changes to both the operating system and the docbase configuration. This is not a minor change within Documentum, so upfront planning and coordination between the Documentum System Administrator and Infrastructure Team is required.
To get the most from this article, you should already have:
For purpose of this document, we are going to refer to the following users:
Original Installation Owner:
username = "dmadmin"
password = "dmadmin"
domain = "it"
New Installation Owner:
username = "new_dmadmin"
password = "new_dmadmin"
domain = "dctm"
The Documentum installation owner is the operating system user that owns the server executable and other related files along with the OS process when the server is running. The installation owner is originally determined when the server is installed; it is the logged-in user that performed the Documentum installation. This user is given the following privileges:
%DOCUMENTUM_HOME% directory.
r_install_owner value in the dm_server_config object.
dm_DataDictionaryPublisher and dm_FulltextMgr
Preparation is an important step when making any major change within your Documentum environment. The following are steps recommended to make your life easier when updating the installation owner.
user_os_name of the docbase useract as part of the operating system on the Windows 2000 machine. This setting can be found
under Control Panel\Administrative Tools\Local Security Settings\Local Policies\User Rights Assignment\Act as part of the operating system
%DOCUMENTUM_HOME%> to remove the old installation owner and add
new installation owner with full control
The simplest way to change the installation owner is to change the existing docbase user’s user_os_name/user_domain. This is the recommended solution in most cases.
user_name within Documentum remains the same therefore the previous installation owner name will appear as the display name within
Documentum.
user_os_name to the new installation owner:
update dm_user object set user_os_name = 'new_dmadmin', set user_domain = 'dctm' where user_name = 'dmadmin';
install_owner and user_auth_target parameters in the server.ini file to reference
the new installation owner and domain for each Docbase in the installation. The server.ini file is located in
%DOCUMENTUM_HOME%\dba\config\docbase_name\server.ini or it can be accessed through the Documentum Server Manager.
%DOCUMENTUM_HOME%). To update permission within Explorer:
%DOCUMENTUM_HOME% are not set out of box with the allow inheritable permissions
from parent to propagate to this object checked. Therefore you cannot assume that a subfolder or file
is inheriting permission from its parent and you must ensure that you update the permission on ALL files and subfolders located under
%DOCUMENTUM_HOME%. %DOCUMENTUM_HOME% subfolders and files that need to be update because they are not
inheriting permission from its parent include but may not be limited to: \data; \data\[docbase_name]\’all subfolders’; \dba; \dba\auth;
\dba\config\[docbase name]\dbpasswd.txt; \dba\config\[docbase name]\webcache.ini; \dba\config\[docbase name]\webcache.ini.old; \dba\log\’subfolders’;
\dba\secure; \dba\secure\aek.key; \fulltext; \product; \share; \share\data\common\’subfolders’; \share\data\events\’subfolders’;
\share\temp\replicate\’subfolders’; \share\temp\dm_ca_store\’subfolders’
Note: If your content storage directories are not located under the %DOCUMENTUM_HOME%\data directory, change the permissions on each content
storage directory as well.
DM_DMADMIN_USER to the new installation owner user name
DM_DMADMIN_DOMAIN to the new installation owner user domain
(C:\Documents and Settings\old_user_name\Start Menu) to the new installation owner
This procedure is recommended if your policies require that the docbase user’s user_name be changed but do not requite that existing objects be assigned to the new user.
user_name within Documentum is updated to the new installation owner therefore it will appear as the display name within Documentum (similar to how it would appear if the docbase had been installed originally as this user).
install_owner and user_auth_target parameters in the server.ini file to reference
the new installation owner and domain for each Docbase in the installation. The server.ini file is located in
%DOCUMENTUM_HOME%\dba\config\docbase_name\server.ini or it can be accessed through the Documentum Server Manager.
%DOCUMENTUM_HOME%). To update permission within Explorer:
%DOCUMENTUM_HOME% are not set out of box with the allow inheritable permissions
from parent to propagate to this object checked. Therefore you cannot assume that a subfolder or file
is inheriting permission from its parent and you must ensure that you update the permission on ALL files and subfolders located under
%DOCUMENTUM_HOME%. %DOCUMENTUM_HOME% subfolders and files that need to be update because they are not
inheriting permission from its parent include but may not be limited to: \data; \data\[docbase_name]\’all subfolders’; \dba; \dba\auth;
\dba\config\[docbase name]\dbpasswd.txt; \dba\config\[docbase name]\webcache.ini; \dba\config\[docbase name]\webcache.ini.old; \dba\log\’subfolders’;
\dba\secure; \dba\secure\aek.key; \fulltext; \product; \share; \share\data\common\’subfolders’; \share\data\events\’subfolders’;
\share\temp\replicate\’subfolders’; \share\temp\dm_ca_store\’subfolders’
Note: If your content storage directories are not located under the %DOCUMENTUM_HOME%\data directory, change the permissions on each content
storage directory as well.
DM_DMADMIN_USER to the new installation owner user name
DM_DMADMIN_DOMAIN to the new installation owner user domain
-install_owner parameter in the value for ImagePath to the new installation owner user name
(C:\Documents and Settings\old_user_name\Start Menu) to the new installation owner
If the requirements around changing the installation owner include changing the Documentum Installation user_name and
removing the old installation user from Documentum, then you must create a new installation Documentum user and reassign the previous user’s objects and tasks to the new
user. This is the most complex, time consuming, and risky procedure and is not recommended unless completely necessary.
user_name within Documentum is updated to the new installation owner therefore it will appear as the display name within
Documentum
The steps are the same as in Approach 2 with the following steps required at the end:
select count(*), acl_name from dm_sysobject where acl_domain = 'dmadmin' group by acl_name
Note: The job may take a while to run depending on the amount of data. Once the query returns no rows the job is complete.
After any major change to your Documentum infrastructure you should Test, Test, Test. Detailed test steps vary based on your Documentum application environment. It is important to have a test plan defined during your preparation. However, below are some brief smoke test steps which should prove helpful:
dm_DataDictionaryPublisher, dm_FulltextMgr , etc.) to ensure they are
successfully running
dm_ConsistencyChecker) Job. This report appears under System/SysAdmin/Reports
%DOCUMENTUM_HOME% can be cumbersome, is there an easier way to
perform this task?%DOCUMENTUM_HOME%. Another shortcut would be to set the local Administrator
group on the Windows 2000 with Full Control permission on all subfolders and files under %DOCUMENTUM_HOME%. Later, when updating
an installation owner you would just need to add/remove users from the local Administrator group. Setting the Administrator group permissions
in this fashion also eases backing up Content Server files.
act as part of the operating system
user_domain attribute of the installation owner:
update dm_user object set user_domain = '[new domain]‘ where user_name = ‘[installation owner]‘
user_auth_target parameters in the server.ini file to reference
the new domain for each Docbase in the installation.
%DOCUMENTUM_HOME% to use the new domain user.
DM_DMADMIN_DOMAIN to the new domain
new domain user
select count(*), acl_name from dm_sysobject where acl_domain = '[old installation owner]‘ group by acl_name;
select r_object_id from dm_sysobject where owner_name= ‘[old installation owner]‘;
Note: Many of the return rows may be log files depending on the last time a log purge was performed. To remove log files from the query
results add and title not like 'Result of%' to the end of the query.
(0 votes, average: 0 out of 5)
Loading ...If you’re running ACS the acs.properties file should also be changed to refer to the new installation owner.
For 5.3SP6 that file is in:
%DOCUMENTUM_HOME%/product/5.3/tomcat_acs/webapps/ACS/WEB-INF/classes/config
Matt Labbe | October 9th, 2009 2:03 pm
You must be logged in to post a comment.
Subscribe to our newsletter to be notified when new articles are posted. You can unsubscribe at any time.
About changing the permissions within the %DOCUMENTUM_HOME% directory I would recommend you to use the following Windows command:
cacls [directory name] /T /E /G [new installation owner]:F
Please use it without the brackets
Omar Morales | August 5th, 2009 11:08 am