Thursday, February 25, 2010

Using service account as CRM4 Web Application Pool identity

I have been trying to resolve a low priority Microsoft Dynamic CRM 4.0 unpleasant user experience for a little while and not going anywhere until today. The user experience is related to Workflow Associated view not returning records. The user can see all Workflow jobs from system job list but not in the Workflow Associated View. There was no error anywhere.
Today, I had to change the CRMAppPool identify from a user account to Network Service temporarily as someone disabled the user account in CRM and no one can login. As soon as this is changed, all users can log into CRM and able to see records in the Workflow Associated view. This lead me to think the original odd behaviour of Workflow Associated view not returning records is related to this CRMAppPool identity user account. So I did a few tests and here are the testing outcomes.

**CRMAppPool identity user account must be a CRM user or Internet Explorer will give user Server Erro in '/'Application - Login failed for user DOMAIN\username. To resolve this, set the CRMAppPool identity to use built-in Network Service account, recycle CRMAppPool and go back to CRM to add the user account. Then change the CRMAppPool identity from Network Service to the user account.

**CRMAppPool identity user account must be Enabled CRM user. If disabled, users will get "The system could not log you on. This could be because your user account or the Business Unit you belong to has been disabled in Microsoft Dynamic CRM." To resolve this issue, set the CRMAppPool identity to built-in Network Service, recycle the CRMAppPool. Re-enable the disabled user account and set the CRMAppPool back to the user.

**CRMAppPool identity user account must have at least 1 Security role assigned or user will get Licence Error in the Workflow Associated View.

**CRMAppPool identity user account should have System Administrator role assigned to work around the issue where Workflow Associated view not returning records.


If you are using the same user account to run the MSCRMAsynService, the same user account must be assigned a full license and system administrator role in CRM.

2 comments:

  1. Kudos for this tip! I was struggling with the same issue - and all I needed was to add the System Administrator role.

    ReplyDelete
  2. We are deciated in building a long lasting relationship with our clients. We achieve this with weekly visits that will allow us to monitor your pool equipment, chemical introduction, and cleaning.
    pool service clayton ca

    ReplyDelete