KNOWLEDGE BASE

WDC Extract refresh failed with error 'Render process terminated - render process exited unexpectedly (exit code=-2147483645)'


Published: 25 May 2021
Last modified date: 02 Aug 2021

Issue

During a refresh of the Web Data Connector extract, it fails with an error 
'Render process terminated - render process crashed (exit code=-2147483645)' 

Environment

  • Windows 
  • Tableau Server 2020.2.7+, 2020.3.6+, 2020.4.2+, 2021.x
  • Web Data Connector (WDC)
  • Kerberos Delegation is disabled

Resolution

  • Confirm you have run through all the other possible connectivity causes to make sure the remediation here is needed :
    • Because the WDC safelist is required by Tableau Server and is not required for Tableau Bridge / Tableau Desktop, if the WDC whitelist is not configured correctly for the Tableau Server, then this leads to:
      1. A WDC refresh with Tableau Server fails with a different error message than shown here
      2. A WDC refresh with Tableau Desktop / Bridge may also work fine
  • For Tableau Server 2020.2.7+, 2020.3.6+, 2020.4.2+, 2021.X, 
    • Tableau Server WDC Extracts will fail with this error if the TSM Run As service account that you specified has administrator rights on the server.   To resolve this issue, change the user account for the Run As Service account to not be a member of the local administrator group
    • Having the Run As Service account with an account that is a member of local administrators or domain administrator is not a good security practice.

Cause

 
  • Web Data Connectors run via QtWebEngine by default (instead of via QtWebKit, which is now deprecated).  
    • QtWebEngine is based on chromium code that is incompatible with the restricted security tokens Tableau Server generates to restrict permissions for server processes when the Run-As User is an administrator.
  • Starting with Tableau Server version 2021.x, QtWebKit has been removed entirely and WebDataConnectors only use QtWebEngine.  In older versions, it is possible to switch WebDataConnectors back to QtWebKit.  This is not recommended, however, as QtWebKit is deprecated and may present security concerns that QtWebEngine does not present.

Additional information

Checking for Administrative group membership

  • It is recommended to get the username of the admin, a listing of all users/groups in the administrator group, and then a listing of any users/groups inside that administrator group as a next step to make sure they don’t still have administrator privileges
  • There are various ways to check for administrator access such as:
    • net localgroup administrators 
      • (\WINDOWS\system32>net localgroup administrators)
    • Run lusrmgr.msc to see the Windows users & groups UI
    • Use Windows ProcessExplorer:
  1. Run ProcessExplorer as admin
  2. Select the tabsvc.exe and open the properties page
  3. Look at the security tab of the properties page (as shown in the screen capture)

Process Explorer - Sysinternals: wwwsysinternals.com [WlN-S9BN4MENlJ  File 0ption5 Vlew Proce% Find lJser% Help  4  Sy"n Praeu  [έ] Sy<an  P" S E exe  , exe  exe  exe  FNP  exe  exe  exe  ca-ho«  .exe  a.n-backVa'&me  ex:e  exe  exe  exe  96,52  < 0.01  < Ο.Ο1  < 001  < 0.01  038  0,38  <0.01  <001  <0.01  , 0.01  < Ο.ΟΙ  < οτι  < 0.01  <0.01  < 001  < Ο.Ο1  Prtvae  οκ  104 K  ΟΚ  536 K  2.112K  1.196K  824 K  2.440 K  3.924 κ  2.904 κ  5.636 K  1.808K  2.948 K  10.816 K  19.400 K  1.696  152 K  17.628 K  692 K  784 K  3.120K  2.368 κ  8292 K  49.796K  56.832 K  1.980K  1.136K  202.180K  209.992 κ  1.128K  760 K  2.580 K  5.096 K  2.176K  448.640 K  507,516 K  768 κ  1.640K  12.532K  1.636K  10.128 K  1.152.080K  1.332.372 κ  16.112K  1.632K  62.100 K  230.472 K  764 K  1.564 κ  6.856 κ  6.736K  6.612 K  7.764 K  ΡΙΟ Hevty  CorTPWTy  264 K  -Ι  ΝΤ AlJTHORlTY,SYSTEN  ΝΤ AlJTHORlTY,SYSTEM  Per%rm.ye  TCP/TP  '*twak  Ll%r•.  5-1-5-2>2600166877-2737186Ι89-399Ι700262-ι009  Ο Ses"': %Ο69  Vrt-±ed: Protected:  Moraor  CONSOLE LOGON  LBbeln  ΝΤ ΑΙ-ΙΤΗΟΑΙ  MBr-dBt  ΝΤ  Τ Al-lTH091TY,LocBl .ccount mernber of μάηιηι«τΜοα  ΝΤ AlJTHORlT'r',SERVEE  ΝΤ ΑΙ-ΙΤΗΟΑΙΤΥ,ΤΡ-•,  M.r,dBt  Grao SID: ηώ  SeOWl%NatyPrtvlege  SeCre&eGobalPrtvdege  SeOeb%Phvdege  En±ed  En±ed  CB±led  Chs±led  En±ed  Devdcgrm  DevdWTW1 „


Tableau advises against using an Administrative user as the Tableau Run As service account as it creates a security risk. If for any reason you needed to put the Run As service account in this group in the past, please take the necessary steps to avoid creating additional conflicts.
Did this article resolve the issue?