Proxy not allowed for subsystem CmdExec when installing Active Directory import utility

Products

• Information Centric Analytics

Issue/Introduction

When attempting to install the Active Directory Connector Utility, installation fails and returns the following error message indicating the account does not have permission or rights to install the application. This occurs even when running the installer under a local administrative user account that has been assigned the sysadmin role in SQL Server.

Could not create SQL agent job: Proxy (3) is not allowed for subsystem "CmdExec" and user "<account_name>". Grant permission by calling sp_grant_proxy_to_subsystem or sp_grant_login_to_proxy.

Environment

Release : 6.x

Resolution

1. Open SQL Server Management Studio
2. Connect to the Database Engine hosting the RiskFabric database
3. Click the New Query button in the SQL Standard toolbar, or select File > New > Query with Current Connection
4. Copy the following statement and paste it in the new query editor window, replacing <ica_service_account> with the ICA service account name:

   USE msdb;
   GO
   EXEC msdb.dbo.sp_grant_login_to_proxy @proxy_name=N'Bay Dynamics AD Connector Proxy', @login_name=N'<ica_service_account>';
   GO

5. Execute the query by pressing the F5 key, selecting Execute from the SQL Editor toolbar, or selecting Execute from the Query menu
6. Run the Active Directory Connector Utility installer using the ICA service account
7. In Object Explorer, navigate to Security > Credentials
8. Determine whether the Bay Dynamics AD Connector Credential is present
   1. If it is not, proceed to step 9
   2. If it is, right-click the credential and select Delete
   3. In the Delete Object window, click the OK button
9. Right-click the Credentials folder and select New Credential
10. In the New Credential window, enter the following values:
    1. Credential name: Bay Dynamics AD Connector Credential
    2. Identity: <ica_service_account>
    3. Password: <password for the ICA service account>
    4. Confirm password:  <password for the ICA service account>
11. Click the OK button
12. In Object Explorer, navigate to SQL Server Agent > Proxies > Operating System (CmdExec)
13. Determine whether the Bay Dynamics AD Connector Proxy is present
    1. If it is, right-click the proxy and select Delete
       1. In the Delete Object window, select the box labelled Reassign to: and select SQL Server Agent Service from the drop-down menu
       2. Click the OK button
    2. If the proxy is not present, navigate in Object Explorer to SQL Server Agent > Proxies > Unassigned Proxies
    3. Determine whether the proxy is present
       1. If it is not, proceed to step 14
       2. If it is, follow steps 13.1.1 and 13.1.2
14. Click the New Query button in the SQL Standard toolbar, or select File > New > Query with Current Connection
15. Copy the following statement and paste it in the new query editor window:

    USE [msdb];
    GO
    EXEC msdb.dbo.sp_add_proxy @proxy_name=N'Bay Dynamics AD Connector Proxy',@credential_name=N'Bay Dynamics AD Connector Credential', @enabled=1;
    GO
    EXEC msdb.dbo.sp_grant_proxy_to_subsystem @proxy_name=N'Bay Dynamics AD Connector Proxy', @subsystem_id=3;
    GO

16. Execute the query by pressing the F5 key, selecting Execute from the SQL Editor toolbar, or selecting Execute from the Query menu