The directions continued (scroll) with --server-datafolder=C:\ProgramData\Duplicati
You confirm the path. Are you sure you secured the right path? Was next failure the same?
I’m pretty sure the command works, as I use it that way before program startup all the time.
Another path concern. Database location on Windows is C:\ProgramData\Duplicati
for current Windows Service install layout. It also shows old one, and non-service one.
If you actually omitted --server-datafolder it might have secured non-service path.
The --help for ConfigureTool has another option that might fit. I don’t know if it flips
the default path to current default for service. Regardless, option’s described like this:
If the data folder is intended to be used by a service account rather than the current user, use the
--for-serviceoption. This excludes the current user from the permissions and instead grants access only to the accounts that the service runs under.
I haven’t used this, and don’t know if it’s really needed. Personally, I like having access as well.
Maybe directions didn’t suggest it, if it’s only for maximum security and gives no other benefits.
IDK
Since Duplicati was from what was thought to be 2.3.0.4, doesn’t user switch fail decryption?
We had a discussion about this, and I think it led to this being added into migration directions:
From version 2.3 the default is to encrypt the configuration database, and you need to decrypt it before copying. If you have disabled database encryption, you can skip the decryption step.
I think this is because using automatic database encryption uses Windows Credential Manager.
I don’t know much about it, but I think it’s per-user, and Service user is not your previous user…