User accounts for running TM1 services on Windows

When you use IBM® Cognos® Configuration to start the Cognos TM1® Admin Server and IBM TM1 Server, they are registered to run as Windows services with the predefined Microsoft Windows Local System Account. You must manually change these services to run under a specific user account.

Note: If TM1 Server requires access to external data sources with ODBC or ODBO, you must manually change it to run under a specific user account that has access to these data sources.

Run TM1 services under a specific Windows user account

By default, Cognos Configuration registers the following TM1 services to run under the Microsoft Windows Local System Account:

  • IBM TM1 Server
  • Cognos TM1 Admin Server
Important: Change these TM1 services to run under a specific user account on Microsoft Windows.

For more information, see Changing TM1 services to run as a specific user account on Windows.

After you make these changes, you will still be able to use Cognos Configuration to start and stop these services.

Required privileges for a specific Windows user account

The user account for running TM1 services on Windows must be included in the database owner group to access SQL tables and views.

The user account must have read and write privileges to the TM1 database and log directories.

The account must have the following privileges on the local computer:

  • Act as part of the operating system
  • Bypass traverse checking
  • Increase quotas (Adjust memory quotas for a process)
  • Replace a process level token
  • Log on as a service
  • Have read and write privileges on the Windows Registry item
Note: Not all of these properties are available in all versions of Windows, such as Windows Server 2012 and newer. Refer to Microsoft Windows documentation for the currently available properties.

You can use the Security Settings and Group Policy features in Microsoft Windows to configure these security privileges. For example, in Microsoft Windows 7, click Administrative Tools > Local Security Policy, and then click to expand Security Settings > Local Policies > User Rights Assignment.

To set read and write privileges for the Windows Registry, use the Windows Registry editor.