Configure Tableau Server Account

By default, the Tableau Server installation selects a built-in Windows system account to start and stop this service. This account is NT AUTHORITY\NetworkService.

To meet Local IT policy requirements or to use NT authentication between Tableau Server and Microsoft data sources, you can specify an account called Run As User. The first section covers the required settings for any setup. The second section covers settings that may be required, depending on your network and computer setup. Screen views and directions are provided for Window 7. Speak to your network administrator for assistance with other operating systems.

Requirements:

• Tableau Server
• Windows login with administrative rights
• Confirmation that these changes conform to local IT policy
• Using multiple domains requires two-way trust between domains

Log in as an administrator to the Windows computer where Tableau Server is installed. A Domain Administrator account is preferable. If, at any point, the following settings or steps are unavailable in Windows or otherwise restricted, speak to your local system administrator about granting the necessary permissions.

Step 1

In Windows, select Start > Control Panel.

Step 2

In the Control Panel, in the View by list, select Large icons or Small icons.

Or

On Windows XP, select Switch to Classic View.

Step 3

Select Administrative Tools.

Step 4

In the Administrative Tools list, double-click Computer Management.

Step 5

In the Computer Management console, click the expand icon for Services and Applications and then select Services.

Step 6

In the Services list, verify that the following services have the required settings

1. Tableau Server (tabsvc)
   • Startup Type: leave as Automatic
   • Log On As: leave the current setting. Change this setting only through Start > All Programs > Tableau Server > Configure Tableau Server
2. tablicsrv
   • Startup Type: leave as Automatic
   • Log On As: leave as Local System account
3. Secondary Logon
   • Startup Type: set to Automatic
   • Log On As: leave as Local System account
4. FLEXnet Licensing Service
   • Startup Type: leave as Manual
   • Log On As: leave as Local System account

Step 1

In Windows, select Start > Control Panel > Administrative Tools > Local Security Policy.

Step 2

In the Local Security Policy window, under Security Settings, select Local Policies > User Rights Assignments > Log on as a service, and then right-click Log on as a service and select Properties.

Step 3

In the Log on as a service Properties dialog box, click Add User or Group.

Step 4

In the Select Users, Computers, Service Accounts, or Groups dialog box (the Select Users or Groups dialog box on XP), type the object name to select, and click Check Names. If the account resolves correctly, the name appears underlined.

Step 5

Click OK.

Step 6

Repeat steps to add the user to the Log on Locally policy.

Step 7

Repeat steps to remove the user from the Deny logon locally policy.

Step 8

Close the Local Security Policy window.

You can configure Windows polices, permissions, and settings in myriad combinations. Depending on
your local IT policy and settings, further configuration may be necessary. Some steps may not be required.

The next step is to make sure that the Tableau Server Run As User account has the necessary permissions at the root of the C: drive.

Step 1

Log in as an administrator to the Windows computer where Tableau Server is installed.

Step 2

Open Computer (My Computer on Windows XP) or Windows Explorer.

Step 3

Right-click Local Disk (C:) and select Properties.

Step 4

In the Local Disk (C:) Properties window, click the Security tab.

Step 5

On the Security tab, click Edit.

Step 6

In the Permissions for Local Disk (C:) dialog box, click Add.

Step 7

In the Select Users, Computers, Service Accounts, or Groups dialog box, type in the account for the Tableau Server Run As User. Do not use a group; specify the account with [domain]\[username].

Step 8

Click Check Names to verify that the account resolves (that is, converts to the name and e-mail address, underlined).

Step 9

Click OK.

The name now appears in the Group or user names list in the Permissions for Local Disk (C:) dialog box.

Step 10

In the Permissions for Local Disk (C:) dialog box, select the new name and check the Permissions table to verify that the Tableau Server Run As User account has Read & Execute permissions.

Note: Read & Execute automatically checks the List Folder Contents and Read permissions.

Step 11

When finished, click OK.

Set permissions at the Tableau program folder.

The final step is to make sure that the Tableau Server Run As User account has the necessary permissions at the Tableau program folder.

Step 1

Browse to the Tableau folder.

• On 32-bit systems: C:\Program Files\Tableau
• On 64-bit systems: C:\Program Files(x86)\Tableau and C:\ProgramData\Tableau folders

Step 2

Right-click the Tableau folder and select Properties.

Step 3

In the Tableau Properties dialog box, click the Security tab.

Step 4

On the Security tab, click Edit.

Step 5

In the Permissions for Tableau dialog box, click Add.

Step 6

In the Select Users, Computers, Service Accounts, or Groups dialog box, type in the account for the Tableau Server Account Run As User. Do not use a group; specify the account with [domain]\[username].

Step 7

Click Check Names to verify that the account resolves.

Step 8

Click OK.

Step 9

In the Tableau Properties dialog box, verify that the Tableau Server Run As User account has Modify permissions.

Note: Modify automatically grants all permissions except Full Control and Special Permissions.

Step 10

Click Advanced.

Step 11

In the Advanced Security Settings for Tableau dialog box, click Change Permissions.

Step 12

In the Permission entries list, select the Tableau Server Run As User account, and then select the check box for Replace all child object permissions with inheritable permissions from this object.

Step 13

When finished, click OK.
Changing these permissions may take a few minutes.

Step 14

When focus returns to the Advanced Security Settings for Tableau dialog box, click OK.

Step 15

In the Tableau Properties dialog box, click OK.

Modify Registry settings.

This is optional and not seen in most environments. If registry security is highly restrictive, grant the
Tableau Server Run As User account read and write permissions to the following registry branches:

HKEY_LOCAL_MACHINE\Software\Tableau

HKEY_CURRENT_USER\Software\Tableau