Skip to content

Option to Enable/Disable Services

IQService has a configuration option to disable unwanted services from an IQService installation.

IQService provides multiple services to communicate to different windows-based end systems. It is possible that for a given deployment, not all services are required. Services which are not required in your deployment can be disabled.

Service Name Description
AD This service is used to communicate with Active Directory.
Lotus Domino This service is used when Delta aggregation/change password is to be performed for a Lotus Domino source.
ScriptExecutor This service is used to run native before and after provisioning scripts.
SharePointServer This service is used if a SharePoint server source is configured.
AzureAD This service is used when native before and after provisioning scripts need to be executed or when Exchange Online mailbox management is to be performed.
WinLocal This service is used if a Windows Local source is configured.
GMSAPasswordData This service allows IQService to retrieve clear-text passwords for Group Managed Service Accounts (gMSA) from Active Directory using Windows PowerShell.

Viewing the Current Status of Services

To view the enabled or disabled status of services, run IQService.exe -g.

To toggle the state, run the following command:

IQService.exe -g <Service Name>
IQService.exe -g AD

Multiple services must be separated by semicolon:

IQService.exe -g AD;LotusDomino

Note

Restart IQService when service status is updated.

Services Enabled by Default

The following IQService services are enabled by default:

  • AD
  • LotusDomino
  • SharePointServer

Services Disabled by Default

The following IQService services are disabled by default:

  • ScriptExecutor - native before and after provisioning scripts (including when the nativeRules feature is configured on an Active Directory source).
  • GMSAPasswordData - gMSA password retrieval from Active Directory.

The ScriptExecutor and GMSAPasswordData services are disabled by default. Related functionality does not work unless IQService is configured to communicate over TLS and an administrator explicitly enables the required service.

To configure TLS and enable services after upgrading from a previous version:

  1. Configure IQService to communicate over TLS, for example:

    IQService.exe -o <TLS_Port>

    Refer to Secure Communication Between VA and IQService for TLS configuration instructions.

  2. Enable each service your deployment requires, for example:

    IQService.exe -g --enable ScriptExecutor
IQService.exe -g --enable GMSAPasswordData

  3. Restart IQService after you update service status.

To disable a service explicitly, run IQService.exe -g --disable <Service Name>.

Refer to Before/After Scripts for IQService for native before and after provisioning scripts. Refer to Using gMSA as a Service Account for gMSA configuration.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.