2

I am writing a puppet script to automate creation of TeamCity agents on Windows 2008 R2 SP2.
For this, I need to set a custom TeamCity service user account via command-line.

So far, I have tried this sequence of commands:

1) Grant my custom account "log on as a service right":

ntrights +r SeServiceLogonRight -u teamcity@omnicorp

Windows confirms command worked successfully:

Granting SeServiceLogonRight to teamcity@omnicorp ... successful

2) Set service user account:

(Get-WmiObject Win32_Service -Filter "name='TCBuildAgent'").Change($Null,$Null,$Null,$Null,$Null,$Null,'teamcity@omnicorp','password')

...command fails with error 21:

__GENUS : 2
__CLASS : __PARAMETERS
__SUPERCLASS :
__DYNASTY : __PARAMETERS
__RELPATH :
__PROPERTY_COUNT : 1
__DERIVATION : {}
__SERVER :
__NAMESPACE :
__PATH :
ReturnValue : 21
PSComputerName :

Here's what I know so far:

  • Error 21 translates to "Invalid parameters have been passed to the service."
  • Username/password are valid - I know this because I am able to make this change via the services.msc snap-in
  • Whenever I apply custom user manually, the above commands start to work (I have tested this on numerous fresh VMs).
  • This tells me ntrights alone is not enough to allow domain account to be used a service user.

This is where I am stuck. All evidence suggests ntrights is sufficient, but something is still missing.

1 Answer 1

2

You can try this :

(Get-WmiObject Win32_Service -Filter "name='TCBuildAgent'").Change($Null,$Null,$Null,$Null,$Null,$False,'teamcity@omnicorp','password')

The 6th parameter correspond to "DesktopInteract", and normally, the service cannot be granted rights to interact with the desktop, unless it is the Local System account.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .