SIMS NTFS Permissions?

[techyphil]

WSSecurity.exe is a file that we have been told to exec. Its a bit like simsperm.bat. However, .ICT gave us it. It was written by one of the tech's there. We are supposed to use it instead of simsperm.bat.

The server is a...
HP Proliant ML370
4GB RAM
2x 3.20Ghz Xeon Cores ( Total of 2 CPU's )
3x SCSI 15k 73GB Drives RAID5

It's getting on now, almost 5 years old.

The speed at which queries are running is very slow. The client's sims goes all white asthough its waiting for a response from the server.

Looking at the server, theres 2 instances of sqlservr.exe. 1 @ 50-60% and the other at 0% but will also raise upto 50-60% at times. When this happens its all maxed out. The MEM usage of one sqlservr.exe is 1,500,500k and the other 212,000k.

I find it really frustrating that .ICT can't help us any more other then defraggin the database!!!1

Please help. I noticed a few other posts about it on here back in 2006 with sqlservr.exe being so high but end up with "capita will fix this in the next update".

[Mcshammer_dj]

What are the sizes of the sims.mdf and ldf. There is a specific tool for defragging the sql data base that can help with slow issues. I would also have a look at the event logs as these can fill up with messages that are not errors.

What version of SQL are you running

[techyphil]

sims.mdf 2,655,000KB
sims.ldf 8,384KB

.ICT ran a defrag query that re-indexed it. Is this the same tool you're referring to?

I've just checked and cleaned the event log's anyway. Nothing much that appears to be anything.

[bossman]

D: is the drive on the server which has S:Sims Folder shared which is then mapped as the S:drive.

Access to the D:drive on the server is as follows:
Everyone: special permissions on this drive only read and execute no inheritance.

on mapped S:drive (Sims shared folder)
1. MIS manager with full control no inheritance
2. Authenticated users list folders read and execute no inheritance

We also have software permissions for users deployed through GPOs:
%UserProfile%\Local Settings\Temp\*.temp
Allows Sims to use self registration for DLLs during installation.

Hope this has been of help

[harvester]

Does anyone actually know "best practice" set of permissions for the SIMS folder on the server? I've been looking for weeks and no one seems to know!!

[glennda]

Does anyone actually know "best practice" set of permissions for the SIMS folder on the server? I've been looking for weeks and no one seems to know!!

i don't think capita do, so the rest of us arn't going to have a chance!

ours have full read/write access to the folders, but not full control so cannot take ownership etc

EDIT:they also have to have read write access to the sims folder on the C:\program files (capita say that you should set them up as local admins) they also need to have access to the sims.ini files in C:\windows plus the temp directory

[vikpaw]

Does anyone actually know "best practice" set of permissions for the SIMS folder on the server? I've been looking for weeks and no one seems to know!!

I think BOSSMAN's post is a working example of very nice strict permissions. The only time you need extra is for certain modules e.g. NovaT or Options, mainly the legacy suite.

i don't think capita do, so the rest of us arn't going to have a chance!

ours have full read/write access to the folders, but not full control so cannot take ownership etc

EDIT:they also have to have read write access to the sims folder on the C:\program files (capita say that you should set them up as local admins) they also need to have access to the sims.ini files in C:\windows plus the temp directory

i remember getting mixed messages when .ICT supported us, but Capita own them now so it should be consistent.

[glennda]

just remembered the sims.ini file is needed for lesson monitor i think not the normal use of sims

[vikpaw]

just remembered the sims.ini file is needed for lesson monitor i think not the normal use of sims

it's needed for NovaT too

[glennda]

i remember getting mixed messages when .ICT supported us, but Capita own them now so it should be consistent.

we are supported by our lea, and the two/three main people that knew what they where talking about left and now they seem to be pretty hopeless, i have just signed up to the capita support site as all they do is search it on there and email it to us! its quicker to cut out the middle man!

[Linfit]

We have found issues with permissions on the SIMS/Setups folder when updates roll out in the past, that seem to require write permission on it,so we have ours set up that way, but I think this is the only place where most SIMS users would need write permissions these days.

Most of our SIMS users have read/execute on the main SIMS folder, Exams Officer has read/write/create on the EXAMIN, EXAMOUT and EXAMHOLD folder. MIS Manager has the same on LEA and the subfolders (for PLASC and CTF files and such) Timetabler full control of the SNOVA folder. In normal use, I'm not sure that there is anything that a typical teacher user needs to access in the SIMS folder at all, apart from connect.ini if, as on our system, there is a redirect to a central copy.

When we moved SIMS to our new shiny server just before Christmas, these were the only folders we copied over; on our old server the SIMS folder was full of junk going right back to the old dBAse files.

....it was a simpler time when you could correct most SIMS problems by deleting the (very many) index files.

[dhicks]

Does anyone actually know "best practice" set of permissions for the SIMS folder on the server? I've been looking for weeks and no one seems to know!!

We run SIMS over Terminal Services, and I think giving users read/write access to a folder inside the Program Files folder would be a bad idea. However that, of all places, seems to be where the QuickLetterTemplate.doc file lives. Therefore, I've just written a Windows service that monitors a separate shared folder with a copy of QuickLetterTemplate.doc in it and copies that file from there as soon as it changes. This way, users csan be given read/write access to the file they want (QuickLetterTemplate.doc) without letting them blunder around in the Program Files folder.

--
David Hicks

[maniac]

2 Groups - SIMS users and SIMS admins

SIMS admins have modify rights to the whole sims drive.

SIMS users have read only rights to the SIMS directory and sub Directories only. Works for us.

On the local machines simsperm.bat is run to set SIMS users to modify rights.

Mike.

[sahmeepee]

Therefore, I've just written a Windows service that monitors a separate shared folder with a copy of QuickLetterTemplate.doc in it and copies that file from there as soon as it changes.

I copy the most up-to-date quicklettertemplate in during logon. They have write access to the sims program files folder as per simsperm.bat, but can't browse to the folder because of GPO settings. It's never been a problem for us, because the template doesn't save into program files by default - it all saves to the DMS now anyway.

There has never been a need for staff to have full access rights to use or upgrade SIMS.

Try removing their write access then installing the client. HINT: It shouldn't try to write to every bleeding folder under s:, but it does.

As far as simsperm goes, it's OK but not perfect. SIMS still does some incredibly stupid things which need manual intervention to sort out. Off the top of my head I can think of:

c:\windows\omrconfig.ini - a file created at the point when you first try to save OMR settings. Typically this will be way after installation and under a normal user account. Therefore an EPIC FAIL awaits. Why they can't consolidate all their bad practice and drop it in the program files SIMS folder I don't know.

c:\pdoxusrs.net - Used by FMS. Again not created during install and requires write access by users. You may notice that it looks like it has something to do with a Paradox database. You may wonder what on earth an 1990s relic is doing in FMS which is now a wizzy, modern, MSSQL-based application. Me too. It's still needed though.

[matt40k]

We run SIMS over Terminal Services, and I think giving users read/write access to a folder inside the Program Files folder would be a bad idea. However that, of all places, seems to be where the QuickLetterTemplate.doc file lives. Therefore, I've just written a Windows service that monitors a separate shared folder with a copy of QuickLetterTemplate.doc in it and copies that file from there as soon as it changes. This way, users csan be given read/write access to the file they want (QuickLetterTemplate.doc) without letting them blunder around in the Program Files folder.

--
David Hicks

It now also looks in the My Sims Documents folder (within My Docs).