Job Processor

[mrB_Young]

Hi!
I'm having an issue with the Job Processor.  (running Vault server 2024 & Vault Pro. 2024 clients)
I've set up a separate account on the Vault server that the JP will use, JPadmin.  The account has only one role - Administrator. So it shouldn't be getting denied anywhere.

But when jobs get sent to the JP, I always get back one of three errors:
 - Visualization file is locked.

 - You currently do not have permissions to download this file. Contact your admin for support.
 - Sync properties failed for the following files:
CC-1005153.ipt: You currently do not have permissions to download this file. Contact your admin for support.;

And I'm getting these errors even on files that are WIP

I've been going through Vault settings. I had made some changes to Lifecylces, but I've reverted the changes trying find out what's happening.
I've experimented on a lifecycle that I hadn't edited.  Still the same result.

So, then I thought, what if I use the Administrator account.
And that account manages to process the jobs without issue.
I have tried using the JPadmin account on another machine - that gave errors too and wouldn't process any jobs.

Why can't the JPadmin account process jobs when it has the exactly the same role as the Administrator account?
Shouldn't both of the accounts behave the same?

[jorgen.bjornes]

admins does not nessecarily have full access to files. Check your lifecycle settings if the JPadmin user (or a group he is member of) has full control over files in all states.

[mrB_Young]

First, thanks for taking the time to reply.

I have checked.  And checked again after your reply.
There's nothing that explicitly denies the JPadmin account.

For example,  and I've have tried this on several lifecycle definitions;  
WIP security is set that Everyone has Read, Modify, Delete & Download rights.
Released is set that Everyone has Read and Download as Allow.  Modify and Delete are blank.

By running the Job Processor as the Administrator user, the job are processed without problem.
If I run the job processor as JPadmin user, then it's denied - even if the file is still set to WIP.
A "normal" user can delete the file.  (I've checked) Yet JPadmin with Administrator privileges gets denied downloading the file.

As I mentioned in my first post, both accounts have a single role set, which is the Administrator role.  (so they're not getting denied by a lesser role)

Neither account is a member of group.  (so there are no group settings that are casing issue)
I've tried adding JPadmin to the security page and setting Allow rights explicitly. Doesn't help.

I just don't see anything that would deny this account.  Especially when the Administrator account works as expected without adding any extra security rules.

I've checked the Effective Access on several files, too.
If I check WIP files, all users except JPadmin have rights to read, modify, delete & download.
JPadmin has read only rights, yet the modify, delete & download are listed as deny.  AFAIK, I've done nothing that would explain why this account is being denied.

_ _ _ _ _ _ 
Edit:
I've just created another admin account to test, single role set to Administrator.
Result - exactly the same as issue above with JPadmin account.  

[gandhey]

Hello,

Please check if you have state based security ? if you have so - you need to explicitly give JPadmin modify rights on the Lifecycle states.

Regards,

Yogeshwar

(Vault team)

[mrB_Young]

Should this not this allow user Admin-JP to do what it needs to do?
I've created a new Lifecycle from scratch. Added just Work In Progress and Released states.
WIP without state based security. Released has Admin-JP with full rights.

yet even in WIP Admin-JP and any other new admin account I create is denied if I do a sync or update DWF.

[jorgen.bjornes]

You set everyone to deny edit in released. That includes admins.. Use blank instead of deny

[mrB_Young]

Tried that too.
I've tried removing Everyone and explicitly adding users, too. 

Tried turning off state based security - no dice.

[mrB_Young]

OK,

Two things!
One, after logging out of the Vault client as my standard user and logging in as Admin-JP, I suddenly saw padlocks all over the place on the folders.
Turns out that someone at an earlier date has setup specific security rules on folders.  This didn't show up as my standard user as I obviously had the correct permissions and I didn't think to check this.
But that has only fixed part of the problem as I still have the same issues on the dedicated JP.

On my workstation I started Job Processor, logged in as Admin-JP.
I sent some files to it for DWF update/properties sync.  Success!!

Paused JP on my workstation, and then resumed on the dedicated JP machine.  Errors again!

I switched back and forward a few times sending different jobs to the JP and every time my workstation was processing then the jobs would go through.
Every time the dedicated JP was processing the jobs ended in errors.

I tried pausing the dedicated JP and resending the failed jobs back to my workstation which processed then jobs without error.

Both workstation and JP machine were using the same user account for all above instances.

So it appears that something is a miss on the machine that the JP is running on.
I shall investigate further.

[mrB_Young]

Follow up question:  when the Job Processor downloads files for processing, where does it download them to?
Are they temporarily downloaded to a location somewhere inside of C:\Program Files ?

If so, could it be the permissions set by the IT department for C:\Program Files is stopping the JP from downloading the files?

_ _ _ _ _
Edit:

Found this information:
https://www.autodesk.com/support/technical/article/caas/sfdcarticles/sfdcarticles/Windows-administra...

Apparently you don't need admin rights.

Well, I don't know that the problem is.
I have now uninstalled Vault on the JP machine, re-installed.  Problem still exists.
JP using same account on my workstation works.

The JP machine has been newly setup in the weekend. Fresh install of Windows and Vault. I tested it and it worked.
It was doing the DXF visualizations, updating properties, spitting out PDFs, DXFs and STPs without error.

Also had it blocking change to release if Title was empty.
When I put the machine into action on yesterday morning it was working. By yesterday afternoon it was just filling up the Job Server queue with error messages.  In most case it is being denied access no matter which account I use for the JP.

I find this really bizarre.  Same account works on one machine but not the other.

[mrB_Young]

I'm not that much wiser than before this little episode.
So, two things were causing issues:
One being the fact that permissions were set for some of the folders in Vault.
The original admin account had access to almost everything which explains why that account worked on almost everything.
The new accounts I set up specifically for the JP had only access to very few folders - newer ones that have been created after the folder permissions were setup.  Seems like whoever did this didn't think this through.
I don't which files & folders the JP initially succeeded on but I guess it must have been on files and folders that it weren't restrictive to certain accounts.

The other issue where the JP still kept getting denied despite sorting out the folder permissions is still a mystery to me.
As I mentioned in previous post, the JP account I was using would process jobs on my workstation but not on the dedicated JP machine.
I tried uninstalling Vault and then installing Vault again on the JP and that didn't help.

I've now just performed a clean install of Windows once again, installed the Vault client software, fired up the Job Processor and now everything is as it should be.  Fingers crossed that it stays this way.

Why this behaviour occurred I don't know. I can only speculate that after the JP first failed something got "stuck" on that machine.

Thanks for your time and patience.  Hopefully I won't be bothering you all with this again.  🙂