Verify Folder Permissions

The account the Tableau Server service runs under is referred to as the Run As service account. The Run As service account needs permission to specific folder resources on the Windows computer.

This topic provides:

  • An accounting of the permissions that are required by the Run As service account.
  • Information about installing Tableau Server in non-default locations.
  • How to reapply permissions on an existing Run As service account using TSM.

This topic refers to the drive where Windows is installed as the system drive. The system drive is equivalent to the Windows environmental variable, %WINDIR%. The drive where Tableau Server is installed is referred to as the install drive.

Resource System or install drive File Path Permissions required
folder system SYSTEMROOT:\windows\system32 Read, List folder contents
executable system SYSTEMROOT:\windows\system32\cmd.exe Read & execute
Drive root install root, for example, Local Disk (C:) Read, List folder contents
folder install PROGRAMFILES\Tableau\Tableau Server Modify
folder install (on system drive) \ProgramData\Tableau\Tableau Server\ Modify
folder install (on non-system drive) \Tableau\Tableau Server\data\ Modify

When you update the Run As service account in TSM, a background process will configure the folder permissions on the Tableau computer for the Run As service account that you specify.

In this case, where you are installing on the system drive into the default folder (C:\Program Files\Tableau), the configuration of folder permissions will be handled by TSM. You do not need to verify or change any folder permissions for this scenario. If you install Tableau Server onto a different drive, you will need to manually configure some permissions.

Installing in a non-default location

If you are installing Tableau Server in a non-default location on a different drive, then you will need to configure permissions on the installation folder for Run As service account as well as the predefined local accounts: Network Service, Local Service and System.

The following table describes the permissions that are applied if you install Tableau Server in a non-default location. All of these permissions are set on the installation folder and are inherited by the subfolders and files in the installation folder. These permissions are configured by the Tableau Setup program and are also reconfigured whenever you upgrade Tableau Server to a new version. Changing permissions on these folders may impair functionality.

For more information about different accounts used by Tableau Server, see Windows Accounts and Permissions.

Set permissions for this account: Permissions required
The user account that is used to install and upgrade Tableau Server Full control
The user account that is used to run TSM commands Full control
System account Full control
Run As service account, Network Service and Local Service Read & execute

Reapplying folder permissions

In some organisations, Group Policy or other system management solutions are used to standardise permissions and accounts on application servers. If your organisation runs a such a solution, be sure to configure the system to accommodate the folder permissions required by the Run As service account. If the folder permissions for the Run As service account have been changed, you can use TSM to reapply the permissions. See Changing an existing domain Run As service account to a different account.

Thanks for your feedback!