Use the provisioning tool to perform the necessary setup for the Jupyter and NotebookExecution services.

The provisioning tool, NINotebookUserSetupCmd.exe, conducts the following operations:
  • Creates or updates the user accounts.
  • Applies all necessary permissions.
  • Recreates the Jupyter profile directory structure for any missing subdirectories.
    Note For example, a directory might be missing from the ProgramData\National Instruments\Skyline\JupyterHub\profile directory hierarchy.

The NIPM installer automatically runs the provisioning tool. Run the tool manually to rotate passwords, ensure functionality after a repair, or restore profile directories.

The provisioning tool applies the following allow rights and deny rights to the SystemLinkNotebooks group.

Table 13. Allow Rights for Provisioning Tool
Path Rights
%ProgramData%\National Instruments\Skyline\JupyterHub Modifies rights for Jupyter profile directories and runtime files.
%ProgramFiles%\National Instruments\Shared\Skyline\Python Reads and executes on all contents, including version subfolders. For example, the provisioning tool works on the 3.8\ subfolder. A lack of Write permissions blocks the pip install command.
Table 14. Deny Rights for Provisioning Tool
Path Rights
%ProgramFiles%\National Instruments\Shared\Web Server Full Control
%ProgramData%\National Instruments\Skyline\Config Full Control
%ProgramData%\National Instruments\Skyline\HttpConfigurations Full Control
%ProgramData%\National Instruments\Skyline\Install Full Control
%ProgramData%\National Instruments\Skyline\KeyValueDatabase Full Control
%ProgramData%\National Instruments\Skyline\Logs Full Control
%ProgramData%\National Instruments\Skyline\NoSqlDatabase Full Control
%ProgramData%\National Instruments\Skyline\PostgreSQLDatabase Full Control
%ProgramData%\National Instruments\Skyline\Python Full Control
%ProgramData%\National Instruments\Skyline\RabbitMQ Full Control
%ProgramData%\National Instruments\Skyline\SkylineConfigurations Full Control
%ProgramData%\National Instruments\SystemLink TDM Index Full Control
%ProgramData%\National Instruments\TDM Server Full Control
%ProgramData%\National Instruments\Skyline\Data Write. This path retains the read and execute permissions from Users membership.
%ProgramData%\National Instruments\Skyline\JupyterHub\profile\AppData\Roaming\Python Write. This path blocks the pip install --user command.

The deny rules on service directories override the read access that accounts inherit from the Users group. These directories include Config and Logs. By default, the Users group has read access and execute access on most %ProgramData% directories.

The deny-write rule on %ProgramData%\National Instruments\Skyline\JupyterHub\profile\AppData\Roaming\Python overrides the Modify right inherited from JupyterHub. Rules are idempotent and scoped to the SystemLinkNotebooks group. These rules do not affect any other accounts.

Syntax for Running the Provisioning Tool

To run the provisioning tool, you must use the following syntax.

Note To use this syntax, run the provisioning tool with Administrator permissions.
NINotebookUserSetupCmd.exe --username <name> --service <jupyterhub|notebookexecution> [options]

Required:
  --username    <name>                         Windows local account name to create or update
  --service     <jupyterhub|notebookexecution> Target service for credential storage

Optional:
  --password      <pwd>    Use a specific password (default: auto-generate 32 chars)
  --hide-from-login        Hide the account from the Windows login screen

Common PowerShell Operations for the Provisioning Tool

Depending on your goal, use the following Powershell operations with the provisioning tool.

Table 15. Common Provisioning Goals
Goal Powershell Operation
Create or update both accounts
Note This operation functions similarly to the installer.
$exe = "$env:ProgramFiles\National Instruments\Shared\Skyline\NINotebookUserSetupCmd.exe"

& $exe --username SystemLinkJupyterHub --service jupyterhub        --hide-from-login
& $exe --username SystemLinkNotebookEx --service notebookexecution --hide-from-login
Note If the provisioning tool fails to create a user, try using a different username with the --username argument. SystemLink allows a maximum username length of 20 characters.
Rotate the password for the JupyterHub user 
& $exe --username SystemLinkJupyterHub --service jupyterhub --password "<user-provided-password>"
Note After rotating a password, you must restart SystemLink services. Trigger a system restart from the SystemLink Server Configuration application.
Use an auto-generated password for the NotebookExecution service.
Note This operation encrypts and stores the password in the service configuration.
& $exe --username SystemLinkNotebookEx --service notebookexecution

Troubleshooting Provisioning Failures

If the provisioning tool fails, the services that depend on the provisioned accounts do not start correctly.

  • NotebookExecution—Shows the failure with an error state in the SystemLink Server Configuration application.
  • JupyterHub—Lists the failure under services with errors. The error message in the user interface is typically generic and does not identify the error as a provisioning failure.

To determine the exact cause of the failure, refer to the provisioning log file in the following location: %ProgramData%\National Instruments\Skyline\Logs\notebookUserSetup.log

The provisioning tool logs a [FATAL] line that describes the specific failure. For example, the line might describe an account name conflict or an access error.

You can also manually run the provisioning tool to view the output directly from PowerShell.

$exe = "$env:ProgramFiles\National Instruments\Shared\Skyline\NINotebookUserSetupCmd.exe"
& $exe --username SystemLinkJupyterHub --service jupyterhub --hide-from-login
Write-Host "Exit code: $LASTEXITCODE"

Depending on the error, take the following steps.

Table 16. Solutions to Common Provisioning Errors
Error Solution
There are missing profile directories

If there are missing subdirectories inside the Jupyter profile directory, kernels might not start. Alternatively, the kernels might return FileNotFoundError. Example subdirectories include AppData, ipython, and jupyter. These subdirectories might be missing after a manual deletion or an installation failure.

Another symptom is a notebook that appears to execute but does not produce an output. This issue can occur when the kernel cannot write the connection file to JUPYTER_RUNTIME_DIR under profile\jupyter\runtime. The kernel process starts but the frontend cannot attach to the kernel. Thus, the system never delivers the cell output.

To address this issue, re-run the provisioning tool in Powershell as an administrator for both services.

$exe = "$env:ProgramFiles\National Instruments\Shared\Skyline\NINotebookUserSetupCmd.exe"
& $exe --username SystemLinkJupyterHub --service jupyterhub        --hide-from-login
& $exe --username SystemLinkNotebookEx --service notebookexecution --hide-from-login

Running the tool again recreates the structure and reapplies ACL.
The notebook fails to start

A notebook session might fail to start even if the provisioning log shows no errors. The most common cause is the SystemLinkJupyterHub account credentials in the JupyterHub configuration file. These credentials are likely out of sync with the actual Windows account password. Re-run the provisioning tool without --password to auto-generate fresh credentials. You then must restart all services.

The session might fail with a generic spawn error even if the JupyterHub log does not indicate a credential problem. You must opt-out of privilege mode and restart the services. If the notebook starts successfully, access restrictions are causing the failure. To identify the missing permissions, refer to the breaking changes table.
The notebook cannot access data after running a cell.

A notebook cell might return a PermissionError exception or Access is denied exception when reading or writing a file path. If there is an exception, the SystemLinkNotebooks group does not have access to that directory. To grant access, refer to Relaxing Permissions for Least-Privilege Mode.

To check the current permissions on the path from inside the notebook, run the following command in Powershell.

import subprocess
result = subprocess.run(["icacls", r"C:\path\to\directory"], capture_output=True, text=True)
print(result.stdout)