Java Windows Agent needs "Create Files / Write Data" permission on the temp folder

Products

• CA Automic Workload Automation - Automation Engine

Issue/Introduction

When running a Windows Job, the user from the login object defined in the object's Attribute section is used to create and write temporary files.

Reports and temporary files output folder can be setup in the Agent's ini-file with the following parameter:

   UC_EX_PATH_JOBREPORT=..\temp
   UC_EX_PATH_TEMP=..\temp

Therefore it needs the "Create Files / Write Data" permission on the temp folder(s) defined in UC_EX_PATH_JOBREPORT and UC_EX_PATH_TEMP.

In the c-based Agent, the temporary files (.bat, .txt, restart)  were written by the agent itself , using the user that was running the agent (either a user or LocalSystem).
So, the c-based Agent didn't need this permission.

If the permission "Create Files / Write Data" is not given the following error is displayed in Messages (MELD), unless logon=0 + ANONYMOUS_JOB=Y is set:

(Read bottom to top):

U02000186 Report file 'C:\Automic\Agents\Windows\temp\OAACFBTI.TXT' for Job 'JOBS.WIN.NAME (1003010)' cannot be opened. Error: 'Access is denied'.
U00011000 'JOBS.WIN.NAME' (RunID: '0001003010') could not be started on '<HOST>'. See next message.

Cause

C-based Agents write the temporary files as Agent user but this was identified as security issue, therefore the Java-based Agent writes all files within the user context of the job.

Resolution

Ensure the user—either directly or through group membership—has the "Create Files / Write Data" permission on the Login object for the Agent's temp folder(s).

By default this is <AGENT>\temp. Otherwise the folders defined in UC_EX_PATH_JOBREPORT and UC_EX_PATH_TEMP.

This will be documented.