Adapting Existing Notebooks to Least-Privilege Mode

Migrate SystemLink Jupyter notebooks to least-privilege mode by addressing permission restrictions, API access, and profile path changes.

SystemLink might place access restrictions on notebooks made prior to the implementation of least-privilege mode.

The following types of users are the most likely to encounter these restrictions:

  • Users upgrading from SystemLink 2026 Q2 or earlier.
  • Users with notebooks that require broader access.

Notebooks that rely on LOCAL SERVICE permissions might fail in least-privilege mode. The following table lists each affected capability and the recommended action.

Table 18. Capabilities Affected by Migration to Least-Privilege Mode
Capability Reason blocked Migration
Reading service configuration files under %ProgramData%\National Instruments\Skyline\Config\ Deny-all ACE Use the SystemLink Python API. The session key for the kernel is available in the SYSTEMLINK_API_KEY environment variable.
Reading or writing to Skyline databases, such as NoSqlDatabase, PostgreSQLDatabase, KeyValueDatabase Deny-all ACE Use the appropriate SystemLink Python API.
Reading RabbitMQ credentials or Salt credentials Deny-all ACE —
Writing to %ProgramData%\National Instruments\Skyline\Data\ Deny-write ACE Notebooks do not require this capability. Use the HTTP API to interact with Skyline services.
Installing Python packages with pip install

Read and execute permissions are present only on the following path. 

%ProgramFiles%\National
              Instruments\Shared\Skyline\Python\<version>\

Also, there is a deny-write ACE on the following path. 

%ProgramData%\National
              Instruments\Skyline\JupyterHub\profile\AppData\Roaming\Python
 Use an administrator to install package requirements. For more information, refer to Python Package Installer Behavior for Least-Privilege Mode.
Reading or writing to shared or custom file system paths SystemLinkNotebooks does not have an explicit ACE. Access depends on the permissions the path already grants to the Users group. For more information, refer to the Provisioning Tool documentation. If SystemLink denies access, you must explicitly grant SystemLinkNotebooks access. For more information, refer to Relaxing Permissions for Least-Privilege Mode. Personal user profile paths under C:\Users\ are not accessible.
Executing privileged commands, such as Restart-Computer or Stop-Service A restricted token removes elevated privileges. Move the privileged operation to a scheduled task or Windows service that runs under an account with the correct rights.
Impersonating other users or accessing the SAM database There is a restricted token. —
Sending HTTP requests through the nisystemlink.* client library The default library CA bundle does not trust the server certificate. Specify the server certificate. For more information, refer to Certificate Errors for NI SystemLink Clients.

Complete the following steps to migrate your existing notebooks to least-privilege mode.

  1. Identify the notebooks that might fail in least-privilege mode.
    Note NI recommends preemptively identifying these notebooks before users encounter failures.
    1. In the following configuration file, temporarily set LimitJupyterPrivileges to false.
      %PROGRAMDATA%\National Instruments\Skyline\Config\JupyterHub.json
    2. In the SystemLink Server Configuration application, restart SystemLink services.
    3. In the SystemLink web interface, navigate to Utilities » Jupyter and run each notebook interactively in JupyterHub.
    4. Record the results.
      The cell output is directly visible in the web interface. By default, the Notebook Execution service does not surface this output.
    5. In the configuration file, set LimitJupyterPrivileges back to true.
    6. Restart and run the services again.
      The following notebooks are candidates for migration.
      • Cells that return PermissionError only under true.
      • Cells that return Access is denied only under true.
      • Cells with a SystemExit exception.
      • Non-zero exit code.
  2. Replace direct file access with HTTP API calls.
    • Notebooks that directly read SystemLink configuration files or database files must use the SystemLink Python API.
    • The nisystemlink-clients library automatically configures authentication when running in a SystemLink Jupyter environment. The library does not need to handle an API key.
    • For raw HTTP requests, use the following session key.
      import os
api_key = os.environ.get("SYSTEMLINK_API_KEY")
    Note If your SystemLink server uses an internal CA certificate, you also need to resolve a certificate error before the library can connect. For more information, refer to Certificate Errors for NI SystemLink Clients. If that fix requires passing an explicit HttpConfiguration, you must supply the authentication parameters as well. Automatic authentication only applies when you do not provide the HttpConfiguration.
  3. Check for a path-sensitive state from previous runs.
    When you enable least-privilege mode, the spawner redirects the following environment variables to a Jupyter profile directory.
    Note Both SystemLinkJupyterHub and SystemLinkNotebookEx share the same profile path.
    Table 19. Environment Variables to Profile Directories
    Environment variables Profile directory
    USERPROFILE, HOME %ProgramData%\National Instruments\Skyline\JupyterHub\profile
    APPDATA %USERPROFILE%\AppData\Roaming
    LOCALAPPDATA %USERPROFILE%\AppData\Local
    TEMP, TMP %USERPROFILE%\AppData\Local\Temp
    SKYLINE_NOTEBOOKS_SCRATCH_DIR %USERPROFILE%\ScratchDir

    Use the environment variables to refer to these paths rather than through hardcoded paths. The variables always point to a writable location under the new profile. Any files previously written to those paths when kernels ran as LOCAL SERVICE are not present at the new paths. When under LOCAL SERVICE, those paths referenced a different physical location.

    Note For notebooks that depend on a previous state, manually copy the files to the corresponding path under the Jupyter profile directory.
  4. Replace in-notebook pip install calls with a Windows administrator that installs packages into the system Python environment.
  5. Grant the SystemLinkNotebooks group access to directories for notebooks that read or write data files outside the Jupyter profile directory.
    For more information, refer to Relaxing Permissions for Least-Privilege Mode.
  6. Move the privileged operations out of notebooks.
    Commands that require administrator rights cannot run in a kernel that uses least-privilege mode. Example commands include restarting services and modifying the system configuration. To comply with least-privilege mode for these commands, implement the following actions:
    • Schedule the commands as Windows tasks.
    • Trigger the commands through a service that holds the correct rights.
  7. Re-enable least-privilege mode.
    1. In the configuration file, verify that LimitJupyterPrivileges is set back to true.
    2. Restart services.