12.14.100 12.13.100 12.12.100 12.11.100 12.10.100 12.09.110 12.09.100 12.08.130 12.08.110 12.08.100
12.14.100 12.13.100 12.12.100 12.11.100 12.10.100 12.09.110 12.09.100 12.08.130 12.08.110 12.08.100 English German
Breadcrumbs

Best Practices for User Access to IGEL UMS Server

Starting from IGEL Universal Management Suite (UMS) version 12.07.100, you can define the user under which the UMS Tomcat services should run. Using a non-root/non-admin user allows you to meet security standards with greater flexibility. In this article, you will find how to define user access and why it is not recommended to start the UMS Tomcat services as root user or admin user.

You can select the service user only during an initial UMS installation. You cannot change the service user during an update installation.

User Access Requirements

The account used to run the installer and the account used to run the UMS Tomcat services have different requirements:

  • Run the UMS installer with administrative privileges on Windows or as root or with sudo on Linux.

  • Run the UMS Tomcat services with a dedicated non-administrator or non-root service user.

Using a dedicated user with the minimum necessary authorizations for the operating system significantly reduces security risks.

We strongly recommend using a user with minimal authorizations in order to follow the principle of least privilege and increase system security.

How to Specify the User in Windows Installation

  1. Create a user that can be used to start the UMS Tomcat services before the UMS installation is started.

    • The service user should not have admin rights.

    • The user must have a valid password.

    • No additional permissions are required, as all necessary permissions are granted during the installation process.

Note for domain environments

The service user specified during installation is automatically added to the local security policy Log on as a service. In Active Directory environments, this right may be centrally managed by Group Policy Objects (GPOs), which can override local settings. Ensure that the service account is also explicitly granted the Log on as a service right within the applicable GPOs. Otherwise, the service will not be able to start.


  1. Run the UMS installer with administrative privileges. Administrative privileges are required so that the installer can assign permissions to the selected service user.


  1. Select the service user during the UMS installation. For details, see IGEL UMS Installation under Windows.


  1. Authenticate the user through password verification.
    All UMS Tomcat services will now be started with this user.

Troubleshooting Windows Service User Permissions

During installation, the UMS installer assigns the required permissions to the selected service user. Existing registry access control lists, explicit Deny permissions, identity-management software, or customer-specific security policies can prevent the installer from assigning these permissions or can remove them after installation. This can lead to unexpected behavior, for example:

  • A UMS Tomcat service does not start.

  • License delivery to IGEL OS devices fails.

To troubleshoot:

  1. Confirm that no explicit Deny entry or centrally managed security policy blocks the installer-assigned permissions.

  2. Check the permissions on these registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Prefs\de\igel\rm\config\rmadminconfig
HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Prefs\de\igel\rm\config\serverconfig

The service user requires read access to serverconfig and rmadminconfig. Access to the serverconfig key is required to allow the UMS to read the configuration values needed for license delivery.

 How to Specify the User in Linux Installation

  1. Create a user that can be used to start the services before the UMS installation is started.

    • The service user should not have root rights.

    • The user must have a valid password.

    • No additional permissions are required, as all necessary permissions are granted during the installation process.


  1. Run the installer as root or with sudo, and select the service user during the UMS installation. For details, see IGEL UMS Installation under Linux.

The watchdog service (used in UMS High Availability) needs root user privileges on Linux. Therefore, this service will be started as root on Linux. 


  1. Authenticate the user through password verification.
    All UMS Tomcat services will now be started with this user.

For password verification, the module pamtester is required on your system. This module will be automatically downloaded as part of the installation process. If you choose not to install it, the installation will only be functional for the root user.