Verify Folder Permissions

The account the Tableau Server service runs under is referred to as the Run As service account. The Run As service account needs permission to specific folder resources on the Windows computer.

This topic provides:

  • An accounting of the permissions that are required by the Run As service account
  • Information about installing Tableau Server in non-default locations.
  • How to reapply permissions on an existing Run As service account using the Tableau Configuration Utility

This topic refers to the drive where Windows is installed as the system drive. The system drive is equivalent to the Windows environmental variable, %WINDIR%. The drive where Tableau Server is installed is referred to as the install drive.

Resource System or install drive File Path Permissions required
folder system SYSTEMROOT:\windows\system32 Read, List folder contents
executable system SYSTEMROOT:\windows\system32\cmd.exe Read & execute, List folder contents
Drive root install root, for example, Local Disk (C:) Read, List folder contents
folder install PROGRAMFILES\Tableau\Tableau Server Modify
folder install (on system drive) \ProgramData\Tableau\Tableau Server\ Modify
folder install (on non-system drive) \Tableau\Tableau Server\data\ Modify

When you update the Run As service account in the Tableau Server Configuration utility, a background process (tabconfig) will configure the folder permissions on the Tableau computer for the Run As service account that you specify.

In this case, where you are installing on the system drive into the default folder (C:\Program Files\Tableau), the configuration of folder permissions will be handled by the tabconfig process when you update the Run As service account in Tableau Server Configuration. You do not need to verify or change any folder permissions for this scenario. If you install Tableau Server onto a different drive, you will need to manually configure some permissions.

Installing on non-system drive or in a different folder

If you have installed Tableau Server on a drive other than the system drive, then you will need to configure the system drive to allow the Run As service account and the Network Service account additional permissions.

Note If you have not changed the Run As service account to use a domain user account, then the default account that Tableau Server uses is the NT Windows system account called Network Service. If your Tableau Server is using the default Network Service account, then the only permission configuration you need to make is to the backups folder, as shown in the final row of the table below.

The following table describes the additional permissions that you need to configure if you install Tableau Server on a drive other than the system drive. If you have changed the Run As service account to use a domain user account, then set all of the permissions in the table below, including the Network Service account.

Resource Set permissions for this account: System or install drive File Path Permissions required
Drive root Run As domain user install root, for example, D:\ Read, List folder contents
folder Run As domain user system SYSTEMROOT:\windows\system32 Read, List folder contents
executable Run As domain user system SYSTEMROOT:\windows\system32\cmd.exe Read & execute, List folder contents
folder Run As domain user install \Tableau\Tableau Server \data\tabsvc\files\backups Read & execute, List folder contents
folder Network Service install \Tableau\Tableau Server \data\tabsvc\files\backups Read & execute, List folder contents

This procedure shows how to modify permissions where the Windows system drive is the C:\ drive and the Tableau install drive is on D:\. Use this procedure to set the permissions specified in the table above.

  1. On the computer hosting Tableau Server (and on additional nodes, if distributed), use Windows Explorer to right-click the Tableau Server install drive, for example Local Disk (D:), and select Properties.

  2. In the Local Disk Properties Window, select the Security tab.

  3. Click Edit, then Add.

  4. In the Select Users, Computers, Service Accounts, or Groups dialog box, type the <domain>\<username> for the Tableau Server Run As service account.

  5. Click Check Names to resolve the account, then OK to confirm.

  6. With the Tableau Server Run As service account highlighted, select List folder contents and Read.

  7. On the bottom of the Security tab, click Advanced.

  8. In the Advanced Security Settings for Local Disk (C:) window, click Change Permissions.

  9. In the Advanced Security Settings for Tableau dialog box, highlight the Run As service account and select the Replace all child object permissions with inheritable permissions from this object check box.

  10. Click OK to apply changes to all subfolders and files - this may take a few minutes.

    Note: You may encounter one or more warning messages from Windows when you apply these changes. For example, a Windows Security warning message will appear that warns that changing permissions on the root directory may reduce security of the computer. In all cases, verify that the warnings are acceptable given the context and continue with the procedure.

  11. Click OK to confirm changes, then click OK in the Local Disk (C:)Properties dialog box.

  12. Follow the steps above to apply the following permissions:

    • Read, List folder contents: SYSTEMROOT:\windows\system32
    • Read & execute, List folder contents: SYSTEMROOT:\windows\system32\cmd.exe
  13. Click OK to exit.

    Note: In some cases, Windows will display a Recycle Bin error: "The Recycle Bin is corrupted. Do you want to empty the Recycle Bin for this drive?" Click Yes.

Reapplying folder permissions

In some organizations, Group Policy or other system management solutions are used to standardize permissions and accounts on application servers. If your organization runs a such a solution, be sure to configure the system to accommodate the folder permissions required by the Run As service account. If the folder permissions for the Run As service account have been changed, you can use Tableau Configuration Utility to reapply the permissions. See Changing an existing domain Run As service account to a different account.

Thanks for your feedback! There was an error submitting your feedback. Try again or send us a message.