SUM OS Logon Failure

[Former Member]

I'm running the latest of SPAM, 1.0 SP9, PL 04.

During the password check of DDIC, OS Specific and DB specific, its failling with

Error message:

OS user password does not work, please reenter: System error: Logon failure: the user has not been granted the requested logon type at this computer.

Saying my SAPServiceSID doesn't work.

I've logged into the server with the account. Works. Password works. I have it admin rights to the server.

I'm even running SUM from the server using SAPServiceSID and doesnt work.

I found note 927637 but I fail to see how to resolve my issue.

Im updating a dual stack 731.

any tips?

[Former Member · Accepted solution]

I think I found the issue, I will confirm after I speak with the DOMAIN Team.

GPO setting, Computer Configuration\Windows settings\security settings\local policies\user rights management\log on as a service.

When I check that GPO, my sapserviceSID isn't listed.

I will confirm

[Former Member · Accepted solution]

Hello Joshua,

I'm facing the same issue as yours.

Is the GPO setting need to be done on AD server? or on my SAP server?

Cause our domain team found nothing about the path.

Please advice.

Thank you.

[Reagan]

There was a similar discussion in the past and I could see that this was fixed by disabling the password policy on the system. Maybe you can try that.

Regards

RB

[Former Member]

Making the GPO changed I described earlier fixed my issue.

[Former Member]

Hi all,

old thread, but maybe that helps.

got this topic with sum sp12 p 11 on windows 2012 after the inst the system was already fine.

Add once mor in the sapcontrol service log on as pw for sapservice user and after that all works fine again. SUM goes on.

Best regards

Thorsten

[Former Member]

Hi,

Please check few thing.

How many sapstartsrv is running on the server. Are all of the same version....

Please check as many times if there are different version of sapstartsrv running the issue happens.

Have you already check 5,6,7,8 and 9...as its posted in the blog before.

1563660 - sapcontrol, <sid>adm authorization issues (SUM)

Thanks

Rishi abrol

[Former Member]

Yes, I did those Steps for Windows. I tried SDEFAULT, DEFAULT, NONE, ALL.

Nothing worked.

I'm leaning towards a windows domain GPO issue for remote service call. I'm investigating.

[ashish_vikas]

are you entering user as <Domain>SAPServiceSID

best regards

ashish

[Former Member]

DOMAIN\SAPServiceSID

[Former Member]

The access to critical methods of the Web service is protected (currently by default: Start, Stop,

RestartInstance, Shutdown, StartSystem, StopSystem, J2EEControlProcess, SendSignal, OSExecute,

J2EEEnableDbgSession, J2EEDisableDbgSession, SetProcessParameter, EnqRemoveLocks). The list of

protected methods can be changed by using the start profile parameter “service/protectedwebmethods”

(blank separated list of method names). To use these methods one has to provide a valid OS user and

password via HTTP basic authentication encoded as UTF8 or must use a trusted connect. The service will

verify the given credentials, and grant permission only to valid users that additionally have execute

permission on the sapstartsrv executable file. Otherwise the request will fail with “Invalid Credentials" or

"Permission denied" fault string. Missing credentials when accessing a critical method will result in HTTP

error 401. Windows users may be given in format <domain>\<user> or <user>@<domain>. On Unix

sapstartsrv will ignore the domain user part. On Windows sapstartsrv will try any trusted domain if no domain

is given.

Question is, Permission to execure SAPSTARTSRV.

Do they mean at the OS Level? If my SapServiceSID is a local admin of the server, he must have those persmissions...or is it elsewhere they are talking>?

[Former Member]

Here is the log

1 ETQ201 Entering upgrade-phase "PREP_PRE_CHECK/PROFREAD" ("20140113134920")
2 ETQ367 Connect variables are set for standard instance access
4 ETQ399 System-nr = '00', GwService = 'sapgw00' Client = '000'
4 ETQ399 Environment variables:
4 ETQ399   auth_shadow_upgrade=<null>
1 ETQ200 Executing actual phase 'PREP_PRE_CHECK/PROFREAD'.
1 ETQ399 Phase arguments:
2 ETQ399 Arg[0] = ''
4 ETQ399 Starting dialog 'Passwords' at 20140113134920.
1 ETQ359 RFC Login to: System="OT4", AsHost="SD01CUDB0105" Nr="00", GwHost="SD01CUDB0105", GwService="sapgw00"
2 ETQ232 RFC Login succeeded
4 ETQ010 Date & Time: 20140113134935 
1 ETQ233 Calling function module "RFCPING" by RFC
1 ETQ234 Call of function module "RFCPING" by RFC succeeded
4 ETQ010 Date & Time: 20140113134935 
4EETQ399 Dialogue validator 'OSValidator' failed with 'OS user password does not work, please reenter: System error: Logon failure: the user has not been granted the requested logon type at this computer.

'.
4 ETQ399 Repeat dialog since input validation failed.

[Former Member]

Worst part of all this. I did the ABAP stack via SPAM..I just want to do the java stack and i used JSPM. Then JSPM updated itselt to SP10 and said I could only use SUM.

I was trying to avoid SUM because its a huge piece of crap.

Now im stuck with an error from the ABAP side.

Irony.

[nirmal_konchada]

Hi,

Is this SAP system a part of network domain??

If yes, see if the below note helps

1821530 - RUNAS ERROR: Unable to run - cmd 1385: Logon failure: the user has not been granted the re...

Also check whether SAPServiceSID is part of local administrators group.

Regards,

Nirmal.

[Former Member]

I ran GPEDIT and checked who had local run rights and sapservicesid was there.

But i did this test

C:\Windows\system32>runas /user:DOMAIN\Service-Account-Name cmd.exe

And yes, it prompted me for the password for SAPSERVICESID, I gave it, and it opened a CMD prompt and I was logged in as a different user.

So it it not a Group policy issue. Must be a web service issue rights

ALso,  In the SUM password field, if I put in a incorrect password I get:

OS user password does not work, please reenter: System error: Logon failure: unknown user name or bad password.

But when I put the proper password, I get a different error.

OS user password does not work, please reenter: System error: Logon failure: the user has not been granted the requested logon type at this computer.

[nirmal_konchada]

Hello,

Please go through the below note:

1563660 - sapcontrol, <sid>adm authorization issues (SUM)

Regards,

Nirmal

[Former Member]

I tried SDEFAULT, DEFAULT and NONE, same error.