Schedules get set to "Disabled" when Users are only in Active Directory Groups but not when they are added to Gallery individually in versions prior to Server 2020.4.
A range of behaviors may be observed, depending on which version of Alteryx Server is running. Initially, this issue showed up as Gallery Schedules for some users being disabled and as errors when viewing Scheduled Workflows. More recently, some workflows were staying in Queued or Running state for an unreasonably long time. It is most common with users that inherit permissions in Gallery from an Active Directory Group rather than having permissions assigned individually to them as Users.
Error loading schedules.
An error was encountered when attempting to load your scheduled workflows.
- Alteryx Server
- Version(s) 2019.2.8+
- Windows Authentication
- Security Accounts Manager Remote Protocol (SAMRPC) first supported in Windows 10 version 1607 and Windows Server 2016 (RTM)
- Additional Tools
- Windows Event Viewer
- Registry Editor
These issues are caused by calls to the SAM (Security Account Manager) database being rejected and resent. You may identify that this is the issue being faced by navigating to Windows Event Viewer>Windows Logs>System. From there, you can filter the current log by Event 16969. The logging of this error is throttled to appear only at the interval set by this registry key: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\RestrictRemoteSamEventThrottlingWindow. The default setting is for 16969 events to be logged every 900 seconds (15 minutes). Please check the General tab of a logged 16969 event to see the number of denied calls to the SAM database during a logging interval. This can affect any of the Server nodes.
Example:
1 remote calls to the SAM database have been denied in the past 900 seconds throttling window. For more information please see http://go.microsoft.com/fwlink/?LinkId=787651.
Along the same lines, Event 16962 shows the current restriction string.
For more information about this error message and the resolution please see the Microsoft Documentation here. That article explains how to modify the restrictions. Work with your IT administrators to loosen the restrictions according to your needs. That article also includes recommendations on how to temporarily set up Audit Only mode so that the details of the triggering events and corresponding activity will be captured. Using that information, the IT administrators can loosen the restrictions appropriately. Microsoft has also published the relevant ACE Strings and the SID Strings.
Alteryx recommends that you work with your IT administrators to implement these changes and also recommends that they back up the registry prior to editing it.
The following information is taken from the above-linked Microsoft articles for the convenience of those administrators, and we recommend that the registry be backed up prior to making any changes (Registry Editor: File > Export)
Per the above-linked article, the default path is HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\RestrictRemoteSam. (If that key does not exist, then it might be that restrictions have not been explicitly configured previously. In that situation, it may be necessary to add the RestrictRemoteSam registry key as a String Value key.)
The default setting per the article is
O:SYG:SYD:(A;;RC;;;BA)
That "grants RC access (READ_CONTROL, also known as STANDARD_RIGHTS_READ) only to members of the local (built-in) Administrators group."
To loosen the restriction you will need to grant further access, which you can do by adding an additional segment to the SDDL string.
O:SYG:SYD:(A;;RC;;;BA)(A;;RC;;;SID)
The SID in the string above is just a placeholder. Please see the Security considerations section of this article, Restrict calls to SAM, and work with your IT Administrators to find an appropriate setting. Some possible ways to loosen the restrictions are: allow the group of users who need access, use a service account SID or equivalent group to enforce least privileged access in the environment.
Adjusting the SDDL string has been demonstrated to resolve the Gallery issues observed when Event 16969 is prevalent. You will need to apply it to every node of your server.
- Microsoft Documentation: Network access: Restrict clients allowed to make remote calls to SAM
- Microsoft Documentation: ACE Strings
- Microsoft Documentation: SID Strings