Running Jira as a Windows NT Service user

[Julian Carroll]

I have Jira setup to run as a Windows service user "NT Service\<service name>". I have granted permissions to that user as follows:

• Full control on c:\program files\Atlassian\Jira
• Full control on c:\program files\Application Data\Jira

The instance appears to run just fine, but I am receiving healthcheck problems, with the following exception:

2019-03-22 11:01:08,578 HealthCheckWatchdog:thread-8 WARN [c.a.t.healthcheck.concurrent.SupportHealthCheckTask] Unable to complete execution of health check Lucene index files location due to an exception
java.util.concurrent.ExecutionException: java.lang.RuntimeException: java.nio.file.AccessDeniedException: C:\Program Files\Atlassian\Application Data\JIRA\caches\indexes

Permissions on this directory show that local user "NT Service\<service name>" has full control. Note that no network files are accessed.

Does the healthcheck run as a different to the service?

[Julian Carroll · Accepted solution]

Turns out this was an inaccurate error from Jira. The permissions issue was actually on C:\Program Files\Atlassian. I granted full access to both the Jira and Confluence service users on this directory and all is working fine. This is a bit of a pain because it means both Jira and Confluence can see and edit each other's directories, which is not great practice from a security point-of-view.

[Mike Rathwell]

Hey @Julian Carroll that is probably the best reason for explicitly setting different JIRA_HOME and CONF_HOME directories.

You can find instructions here:

• https://confluence.atlassian.com/adminjiraserver073/setting-your-jira-application-home-directory-861253889.html
• https://confluence.atlassian.com/confkb/startup-check-setting-your-confluence-home-935907597.html

[Mike Rathwell]

Hi @Julian Carroll 

Check the permissions on explicitly the "indexes" directory. It's entirely possible they didn't propagate down the tree.

Another consideration is that perhaps it'd be better to configure the JIRA_HOME to be some file system other than Program Files, preferably in a path that doesn't include spaces in it. You could be tripping over that as well.

[Julian Carroll]

Thanks @Mike Rathwell but permissions seem to have propagated successfully. The service account has full control on the indexes directory. Thanks for the suggestion regarding changing JIRA_HOME, but this is an existing instance so I don't have the ability to move it from Program Files.