FIX: A hotfix is available that lets you manage BizTalk RFID in Microsoft BizTalk Server 2006 R2 by using an account that is not a local administrator RFID

1. Extract the hotfix package to a local temporary folder. Apply the update by running the Setup.exe file.
2. Create a user group that is named RFID_ADMIN, and then add the users who have to perform BizTalk RFID-related administrative operations to this group.
   
   Note After a user is added to this group, the user has permissions to perform all operations that are provided by BizTalk RFID.
3. Grant the Full Control permission to the RFID_ADMIN group for the following directories:
   • %RFIDINSTALLDIR%
   • %RFIDINSTALLDIR%\bin
   • %RFIDDATADIR%
   • %RFIDDATADIR%\Processes
   • %RFIDDATADIR%\Providers
   • %RFIDDATADIR%\Logs
   Note You must explicitly grant permissions to the RFID_ADMIN group for these directories. This is because the sub-directories do not inherit permissions from their parent directories.
4. If you use Business Rules Engine (BRE), you must modify SQL Server to let you use the Rule Engine Policy Executor that is included with BizTalk RFID. To do this, follow these steps:
   1. On the instance of SQL Server that hosts the BizTalk Rule Engine database, create a SQL Server “RFID_ADMIN” logon that uses Windows Authentication.
      
      Note BRE does not support the rule engine database if the rule engine database is located on a remote computer.
   2. Add the RFID_ADMIN logon to the BizTalk Rule Engine database. By default, the name of the database is "BizTalkRuleEngineDb."
   3. Add the RFID_ADMIN logon to the RE_HOST_USERS database role in the BizTalk Rule Engine database.

Back to the top

Managing RFID server from a remote computer

1. Download and install the PsGetSid tool. This tool will retrieve the SID of the RFID_ADMIN group that you created earlier. To obtain the PsGetSid tool, visit the following Microsoft TechNet Web site:
   http://technet.microsoft.com/en-us/sysinternals/bb897417.aspx (http://technet.microsoft.com/en-us/sysinternals/bb897417.aspx)
2. Open a Command Prompt window. At the command prompt, type the following command, and then press ENTER:
   psgetsid RFID_ADMIN
   This command outputs the SID of the RFID_ADMIN group. The SID is located on the last non-empty line of the output. For this example, we'll use the <SID of RFID_ADMIN> placeholder for the SID. Copy the SID into Notepad.
3. At the command prompt, type the following command, and then press ENTER:
   sc sdshow msbiztalkrfid
   This Command outputs the Security Descriptor of the BizTalk RFID service in SDDL. Copy the descriptor into Notepad.
4. Add permissions for the RFID_ADMIN group.
   
   The SDDL string is typically a concatenation of a DACL and an SACL. Every ACL is a concatenation of ACEs. The SDDL string is a concatenation of these two parts in the following format:
   D:(<DACE_1>)(<DACE_2>)…S:(<SACE_1>)…
   Note In this string, D represents the DACL, and S represents the SACL.
   
   To add permissions for the RFID_ADMIN group, follow these steps:
   1. Compose the DACE that you want to add for the RFID_ADMIN group. For example, the DACE string of "A;;GR;;;<SID of RFID_ADMIN>" is the DACE to grant the RFID_ADMIN group "Generic Read" access to the service.
      
      This access is enough to query the status of the service from any computer. This process will work by connecting to the RFID Service from a remote RFID Manager. However, if you have to enable members of the RFID_ADMIN group to also start, stop, or configure the service, you must grant this group full access. To do this, use the following DACE string:
      A;;GA;;;<SID of RFID_ADMIN>
      You can vary the string to grant different kinds of access to the RFID_ADMIN group to the BizTalk RFID service. In this example, the DACE string that you have selected is represented by using the <RFID_ADMIN_DACE> placeholder.
      
      Note The semicolons in the DACE string are important. You should replace only the SID and Access mask parts of the string. Do not change any other parts of the string.
   2. Add the DACL that you created in step a to the end of the list of DACLs in the SDDL string. This will prepare a new SDDL string. The new string should resemble the following:
      D:(<DACE_1>)(<DACE_2>)…(<RFID_ADMIN_DACE>)S:(<SACE_1>)…
      Note The parentheses around the <RFID_ADMIN_DACL> placeholder are important.
   3. At a command prompt, type the following command, and then press ENTER:
      sc sdset msbiztalkrfid <The SDDL string prepared in step b>
      This command applies the new permissions to the BizTalk RFID Service object.

Back to the top

Deploying RFID processes

Back to the top

How to enable or disable a process deployment in RFID Manager

<AutoDeployProcessesOnStart>false</AutoDeployProcessesOnStart>

• The RFIDTools.config file is located in the %RFIDINSTALLDIR%\bin directory.
• The <AutoDeployProcessesOnStart> flag may be missing from RFIDTools.config file after you apply this hotfix. In this case, RFID Manager will deploy the RFID process before the process is started.
• RFID Manager must be restarted for any changes to the RFIDTools.config file to take effect.

Back to the top

Hotfix information

Prerequisites

Restart requirement

Hotfix replacement information

File information

Back to the top