Tabledata 2000000001 does not exist + NAS + SQL 2008

fufikk

Hi,

I receive the above error message at our customer's server when trying to run NAS. The configuration is: Navision 4.0 sp2, Windows Server 2008 x64, SQL 2008 x64. The test environment (sql 2005, navision 40sp2, win 2003) is working correctly. The only difference in Navision security setup is the user account used for NAS. In test environment it's a local windows user and in production environment it's a domain user. Both of them have SUPER role assigned.

The things I tried so far:
- synch. permissions = FAIL,
- remove entries from permission table where Object ID <> 0 and object name = '' + synch. permissions = FAIL,
- remove all mods from production database and chceck if NAS starts with different error message = FAIL,
- put test database (working with nas under SQL 2005) to production environment = FAIL.

Does anybody have any idea what else to check/change/test/modify in Navision or Domain user account or SQL 2008 setup?

Tonight I'm probably going to restore one of the companies under 4.0 sp3 to see if it works. However I would like to use that as the last resort since there are 50+ companies in production database and previous migration to SQL took days and days. I'll follow up upon completing the test.

In the mean time, any suggestions are welcome

ara3n

You need to add to ALL role table 200000001. This is the session table.
I also suggest to do an exe upgrade to the latest version and use standard security model, so that you don't need to sync security.

Slawek_Guzek

fufikk wrote:

The only difference in Navision security setup is the user account used for NAS. In test environment it's a local windows user and in production environment it's a domain user.

What about SQL level security settings ?

Under which account are you logged in when doing synchronization ? The same, different but one of mentioned above, completely different account or logged as local SQL administrator ?

Is NAS installed on one server with SQL ? If yes - do you use LocalSystem or LocalService to run NAS ? Is local account member of local Administrator group ?

Regards
Slawek

fufikk

Backup was restored with 4.0 sp3. This time NAS showed different error about invalid user or password. From Navision application things looked right: windows logins contained valid domain user with assigner roles (SUPER & ALL), synchronization completed without errors.
After requesting and gaining access to SQL Server I found 2 things that were not right:
- domain user was not in the sysadmin role,
- extended stored procedures (xp_ndo_enumusergroups & xp_ndo_enumusersids) were not added to master database.
Having done that I started SP3 NAS without any error messages. The same applied to SP2 NASes.

Guess I was mislead by not seeing the usual error message when regular client app logs to navision with windows auth. and did not check that on the very beginning. Luckily, SP3 NAS provided me with error that pushed me in the right direction.

Hours would be saved, any way I'm glad I got that running.

Still, I'm not sure about the sysadmin role of domain user. With that I followed kriki's 'How To':

http://www.mibuso.com/howtoinfo.asp?FileID=15

Slawek_Guzek

Hi,

Domain account used for NAS does not need to be member of sysadmin role. I woud say it should never be member of sysadmin because this is quite big security hole.

Sysadmin (or alternatively db_owner + securityadmin) are required only for accounts used to add/remove logins and/or synchronize security. For normal operation public access to the database is enough.

Regards,
Slawek