81256

TFS Integration Build Powershell With Elevated Privileges

Question:

I am setting up an integration tests build where I am just trying to start up a windows service.

I have used the InvokeProcess command to run the powershell scripts which just does the following

<strong>Start-Service ServiceName</strong>

The script fails when I run the build process but when I executed the same script outside TFS it works. I get the following error in TFS logs

<em>Start-Service : Service 'ServiceName (ServiceName)' cannot be started due to the following error: Cannot open ServiceName service on computer '.'.</em>

Then I tried changing the way I am starting the service and used SC.exe with parameters <strong>"Start ServiceName"</strong> in the InvokeProcess and I get Access Denied error in TFS as follows:-

<em>SC start ServiceName. [SC] StartService: OpenService FAILED 5: Access is denied.</em>

I am using Network Service account to run the build.

After searching a while, I have come to the conclusion that I have to run the InvokeProcess with elevated privileges but I don't know how would I do that with in TFS.

Any help is much appreciated.

Answer1:

We run our build agent as a custom service account and give that domain account admin access on the servers we deploy to.

Answer2:

I have resolved the issue by adding Network Service account to the administrator group. I might not go with this solution as it seems wrong to assign administrative rights to Network Service account but I don't know how to assign Service Start/Stop permissions to Network Service without adding this account to Administrator group.

In short, I agree with the answer that a custom service account must be used to run the build with appropriate privileges.

Recommend

  • How to handle Azure AD Authentication with Kubernetes Ingress
  • How to install mysql from batch file?
  • Service {ServiceName} was not found on computer '.'
  • TFS 2017 vNext Build Get workspace with powershell
  • Publishing test results through command line test runner in VSTS
  • How to shutdown a single application in Tomcat?
  • TFS Builds: Running the builds as administrator
  • TFS edit build log using custom activity
  • Find VMID for running instance
  • Thread synchronization with syncwarp
  • include dlls in visual studio c++ 2008
  • NSIS decompiler
  • C# - Most efficient way to iterate through multiple arrays/list
  • Consuming a WCF service in a Java Client using wsHttpBinding
  • How can I run DataNucleus Bytecode Enhancer from SBT?
  • netsh acl setting (need alternative method - registry settings?)
  • Jquery Knockout: ko.computed() vs classic function?
  • How can I replace the server in Web Component Tester
  • aapt.exe'' finished with non-zero exit value 1
  • Clear activity stack before launching another activity
  • Jenkins: FATAL: Could not initialize class hudson.util.ProcessTree$UnixReflection
  • Tamper-proof configuration files in .NET?
  • Code in Job's Script Block after Start-Process Does not Execute
  • Bad request using file_get_contents for PUT request in PHP
  • Record samples being played with OpenAL
  • How to recover from a Spring Social ExpiredAuthorizationException
  • How to redirect a user to a different server and include HTTP basic authentication credentials?
  • ILMerge & Keep Assembly Name
  • Running a C# exe file
  • Can I make an Android app that runs a web view in Chrome 39?
  • ActionScript 2 vs ActionScript 3 performance
  • Large data - storage and query
  • WOWZA + RTMP + HTML5 Playback?
  • SetUp method failed while running tests from teamcity
  • Hits per day in Google Big Query
  • What are the advantages and disadvantages of reading an entire file into a single String as opposed
  • FormattedException instead of throw new Exception(string.Format(…)) in .NET
  • LevelDB C iterator
  • Linking SubReports Without LinkChild/LinkMaster
  • XCode 8, some methods disappeared ? ex: layoutAttributesClass() -> AnyClass