DP4 on Windows Vista and Windows 7

Due to changes in the base OS DP4 may not work as well on Windows Vista or Windows 7 as on previous releases of Windows and may require configuration file changes to work at all. In the name of security, Microsoft have chosen to remove important functionality that DP4 depends on. There is very little we can do about this. New versions of some components and some new DP4 components are available that address some problems that affect users running DP4 on Windows Vista or later, or through a remote desktop connection on Windows Server 2003.

Configuring the DP4 interface

In order to run DP4 on Windows Vista, Windows 7, Windows Server 2008, or later Windows releases, you first need to decide whether to run the DP4 core components as an application, or as a service.. Running DP4 as an application is necessary if you want to be able to start and stop DP4 when running in an ordinary user account, for example if you want a user to be able to initiate "end of day" type operations, which might typically stop and restart DP4 in various different configurations at various points. Running DP4 as a service is necessary if you want the data in the databases on that machine to be available to DP4 network clients even when no user is logged onto the machine. If you have both these requirements then either the user will have to have full administrative rights, ("power users", who in earlier versions of Windows can start and stop services, can no longer do so), or you will have to configure either the group or the local security policy to enable specific users to be able to start and stop DP4. If DP4 is to be run as a service then it needs to be set to start automatically, because the auto-load mechanism does not work properly on these versions of Windows due to "Access Denied" errors that the OS returns to DP4 at various points.

Running DP4 as an application

To run DP4 as an application two changes are required in dp4.ini.

In the [win32] section, specify a null value for namespace like this:

[win32] namespace=
In the same section, change the loader string to start DP4 as an application instead of a service:

loader=srvw32.exe -load

Once these changes have been made DP4 will run normally. However, there will be problems if a DP4 application is running in one desktop, and then you use fast user switching to create another session and try running a DP4 program in that session. These problems would be circumvented if DP4 is set to use "global" memory. This would be the case if you do not make the first change above. However, in this case DP4 will only work if UAC is disabled completely, because otherwise DP4 will get access denied errors.

Running DP4 as a service.

The instructions below assume you are running DP4 4.624. The additional components mentioned in items 2 and 3 below are also available for 4.623, but may be unreliable.

If DP4 is not already installed as a service then run srvw32 -install to make the required changes to the registry.
Using Control Panel "services.msc" change the DP4 service so that it is started automatically.
If you would like the user to be able to tell whether the DP4 service is running or not, then insert a shortcut to dp4tray.exe in the startup folder for all users, or for specific users. Services cannot interact with regular desktops because of "Session 0 isolation".
If you would like DP4 programs to be able to log errors to debug.txt then add the utility errpipe.w32 to the startup section. (There is no point doing this unless load_errlog=1 is set in the [system] section. A suitable startup section for a typical DP4 installation might look like this:
```
[startup]
1=errpipe.w32
2=dp4srvr.w32 -aux
3=tcpw.w32 -server_name localhost -debug_error
4=tcpmgr.w32 -nonames -aux -debug_error -nocopy
```

Granting other non-administrative users control over DP4 service

The subinacl utility, available as a free download from Microsoft, can be used to do this.

A suitable command line might look like this:

subinacl /service dfsolutions grant=account=F

dfsolutions is the internal name of the DP4 service unless you have used the [branding] section of dp4.ini to set a different service name.

Here account=F would be replaced by either by a group or individual user account name. F grants full control of the service. Other options are supposedly possible, but the author of this document could not get this to work.

Alternatively you can use group policies to do the same thing. Consult the documentation specific to your version of Windows Server to discover how to do this.

Note that even if you do this that DP4 programs will not be able to autoload the DP4 service correctly. If a DP4 program is started before the DP4 service is running, it will successfully be able to start the DP4 service, but the program itself will fail with an access denied error. The next program to start will be able to run normally. This problem will probably go away if UAC is completely disabled. This problem will be fixed in a patch release if possible.

Windows Firewall

If the Windows Firewall is enabled and you want to use DP4 networking then you need to remember to open a port for DP4 to use. By default DP4 uses port 5000. However, this may not be the best choice to use, as it may conflict with the SSDP discovery service. Consult the list of well known port numbers on the IANA web site to find a suitable port number for DP4 to use instead. Most port numbers in the range 10861-10999 are unassigned, so are probably safe to use, or you can use one of the port numbers in the private/dynamic range (49152-65535). If you want to use port 5000, you should disable the SSDP discovery service, as otherwise actions such as inserting a USB memory stick can disrupt connectivity to tcpmgr.w32. On the other hand, disabling SSDP discovery may adversely affect the operation of some USB printers.

REPSETUP IMPSETUP DFSETUP

UAC assumes that any program that has SETUP in its name is an installation program and demands that the user enters an adminstrator password before allowing it to run. Therefore, if you want to use any of these programs in a non-adminsitrator account with UAC enabled you may need to rename them. It is also necessary to patch the Windows version information for the program to remove all occurences of the string "SETUP", otherwise the UAC dialog will still be produced. There does not seem to be any way of preventing this dialog from appearing, (which is probably an intentional security feature). If this is a significant problem we will make available alternative versions of these utilities with different internal names, and a modified system database.

DFPRINT

6 Jun 2008 We have recently become aware of an issue with DFPRINT, which, so far as we know, is confined to Windows Vista (it does not arise on Windows 7). The issue is as follows: if the user selects the "Print" button, but then cancels the Windows printer selection dialog that appears and then exits DFPRINT, then DFPRINT does not actually terminate. In fact the issue only arises when DFPRINT is run "locally" : if run via a remote desktop connection there is no problem.