DB2 – How to Create a Windows User for Installing DB2 Server with Extended Security

db2db2-10.5db2-luwwindows-server

I'm trying to install db2 10.5 on Windows Server 2008 not as built-in "Administrator", but as another local user, but it fails to create instance with the symptoms similar to http://www-01.ibm.com/support/docview.wss?uid=swg1IC85663

First it complains it cannot create DB2ADMNS and DB2USERS groups (in fact, the groups appear after installer dies)

Then there's a another mesage:

The creation of the process for the partitioned instance failed.
Return value is "4294965337".

I don't have Active Directory. All users are local. Here's how I create the user for installing db2:

net user db2installer s3cret /ADD
net localgroup Administrators db2installer /add

I don's see any difference between "Administrator" and "db2installer". Perhaps "db2installer" should be added to some security policy?

Best Answer

Problem solved by setting

 Security options/User Account Control: run all administrators in admin approval mode = Disabled

in Local Security Policy

Related Solutions

Disable Security in DB2 Express on Windows 7

The short answer to this problem is that you need to set the DB2 registry variable DB2_GRP_LOOKUP to local.

As a local administrator on your PC (i.e. not using your domain account), start a DB2 Command Window and issue the following:

db2set DB2_GRP_LOOKUP=local
db2stop
db2start

The reason this occurs has to do with how DB2 enumerates which groups a user belongs to upon successful authentication. In a Windows Domain environment, the default group enumeration behavior is to ask the system that authenticated the user: If a user is authenticated by the local machine, DB2 asks the local machine what groups belongs to; if the user is authenticated by the domain, DB2 will ask the domain what groups the user belongs to - and it will not ask the local machine.

So, when you connect to DB2 using your domain ID, DB2 asks the domain controller what groups you belong to, so it does not see that your ID belongs to the Administrators group on your local PC.

When you set DB2_GRP_LOOKUP=local, this modifies this behavior: It tells DB2 to always enumerate groups from the local machine, regardless of whether the user was authenticated by the domain or the local machine.

After doing this, DB2 will see that your Domain ID belongs to the local Administrators group, and you'll end up with full SYSADM privileges (and the ability to create a database).

DB2 9.7 LUW – How to SET SESSION_USER when I am DBADM,SECADM

Ok, I think I actually figured out how to handle this. I needed to grant the ability for my DBADM,SECADM to transfer to any ID through the group not the specific ID. In this way I get around the SECADM restrictions.

db2 grant setsessionuser on public to group DB2ADMNS

Since my ID db2admin is in this group, it can now switch to any ID (the public part). If I only wanted to be able to switch to that ID, I could have used:

db2 grant setsessionuser on user bobabob97 to group DB2ADMNS

So now I can perform

db2 set session_user=bobabob97

and it works.

To switch back I only need to run

db2 set session_user=system_user

Best Answer

Related Solutions

Disable Security in DB2 Express on Windows 7

DB2 9.7 LUW – How to SET SESSION_USER when I am DBADM,SECADM

Related Question