Starting SAP with a Script after a VM Restore

[Former Member]

Hello,

On a daily basis we restore the Training System to a VM Check Point backup, taken some days ago.

This script runs on Windows Server 2012, and SQL Server 2012.

The script consists of the following:

----------------------------------------------------------

sc config "SAPEQ1_00" start=Auto

sc config "SAPEQ1_01" start=Auto

timeout /t 15 /nobreak

net start "SAPEQ1_00"

net start "SAPEQ1_01"

startsap name=EQ1 nr=01 SAPDIAHOST=<Hostname>

startsap name=EQ1 nr=00 SAPDIAHOST=<Hostname>

startsap name=DAA nr=98 SAPDIAHOST=<Hostname>

-------------------------------------------------------------

the “sc config*” and “net start*” work perfectly, but unless eq1adm has been used to logon the SAP system does not start. Using the Windows Task Scheduler.

Has anyone seen this behavior before?

The task to run the script is run from the Task Scheduler and is configured to "Run wether user is logged on" and "Run with Highest privileges"

with <sid>adm

[isaias_freitas · Accepted solution]

Hello David,

Are the Windows Services SAPEQ1_00 and 01 being started as "SAPServiceEQ1"?

Do you see any error when the issue is simulated? Where? What is the error?

Instead of "startsap", have you tried to use "sapcontrol -nr <instance> -function Start" at your script?

Regards,

Isaías

[Former Member · Accepted solution]

Hi Isaias,

Thank you for your helpful reply.

Yes the Windows Services are being run by "SAPServiceEQ1"

We are looking at using sapcontrol, but there is an issue with having the password of eq1adm in free text.

Regards

David

[isaias_freitas · Accepted solution]

Hello David,

You're welcome!

Under which user ID is the scheduled task being started?

If it is a local administrator, you should not need to pass the eq1adm password in the command line.

Regards,

Isaías

PS: I do not see how the "service/*" parameters would help here

[Former Member · Accepted solution]

Hi Isaias,

I had a similar situation. Using the power-shell script for MS Security Patches and subsequent restart and was getting the same "HTTP error, HTTP/1.1 401 Unauthorized" which was fixed by adding the service* parameters following Note 2010805 - SAP MMC common issues .

Since the script was calling the sapcontrol from one SAP system and taking care of all the other systems in the landscape I had to add the sidadm of the central system in the profile for all the other managed system.

The script is working fine ever since then. In case there is something which I need to re-check please do let me know.

Thanks,

Manas

[isaias_freitas · Accepted solution]

Hello Manas,

If one script would start different systems, then it makes sense to set "service/admin_users".

Setting "service/protectedwebmethods = OSExecute" is basically disabling the authentication requirement to any method except "OSExecute".

This means that any user would be able to call the method "Stop", for example, which could lead to a production down situation (if the involved system is a productive system ).

Setting "service/protectedwebmethods" can be used as emergency workarounds (e.g., during upgrades). But it should usually not be set.

Cheers!

Isaías

[Former Member · Accepted solution]

Thanks Isaias, We thought of this while setting up the script but the access to Production system is restricted and they are all behind a security software. When you say any user will be able to call the method "Stop" does that mean for those who are access to the VM on which the instance is running.

Thanks again for providing your inputs, I will check these scenarios ASAP.

Thanks,

Manas

[isaias_freitas · Accepted solution]

Hello Manas,

Anyone who can reach the server through the TCP/IP port "5XX13" or "5XX14" would be able to call the "Stop" method (or any method other than "OSExecute", actually).

* "XX" stands for the instance number

By "reach" I mean not only locally (while logged on to the SAP server itself), but remotely as well.

Regards,

Isaías

[Former Member]

Hi David,

Can you check if the below parameters are maintained in your SAP system Default/Instance profile:

• service/protectedwebmethods = OSExecute
• service/admin_users=.\<sid>adm

Thanks,

Manas

[Former Member]

Hi Manas 

I have added the two parameters to the Default profile and restarted the system. commands 
 

service/protectedwebmethods = OSExecute
service/admin_users=.\<sid>adm


When I try the commands 

[Former Member]

Hi David,

have you replaced <sid> with EQ1 in the second parameter.

Thanks,

Manas

[Former Member]

Hi Manas,

Yes I have I am using eq1adm

Regards

David

[Former Member]

And running the script on the same VM where EQ1 application is running while logged in as eq1adm?

If you are using some other ID to run this script you will have to maintain that as well in the second parameter.

thanks,

Manas

[Former Member]

Hi Manas,

Yes I was logged on and ran the syntax using a command prompt. I want to test the Syntax first.

Thanks

David

[Former Member]

Please check Point 4 of Note 2010805 - SAP MMC common issues and maintain parameter service/protectedwebmethods = OSExecute in start profile as well.

I believe currently you must be prompted for password even if you try to stop/start from MMC.

Thanks,

Manas

[Former Member]

David - Were you able to test after maintaining the parameter service/protectedwebmethods = OSExecute in the start profile.

Thanks,

Manas

[Former Member]

Hi Guys,

Thank you for your advice.

I am logging in as eq1adm and the user ID is a domain account but also exists in the Local Admins Group.

I set the Service parameters in the DEFAULT profile and also in the host_profile in the hostctrl\exe folder. I stopped and Started SAP and also the hostctrl services, bit was still getting the error:

FAIL: HTTP error. HTTP/1.1 401 Unauthorized.

However this morning I ran the following:

"C:\Program Files\SAP\hostctrl\exe\sapcontrol.exe" -nr 00 - host <host> -function Start

"C:\Program Files\SAP\hostctrl\exe\sapcontrol.exe" -nr 01 -host <Host> -function Start

And then this time the system started

[Former Member]

Hi David

Though you have solved the error, kindly look at the SAP note 1565645 - SAP composite note: sapcontrol

Regards

Prithviraj