I am writing a puppet script to automate creation of TeamCity agents on Windows 2008 R2 SP2.
For this, I need to set a custom TeamCity service user account via command-line.
So far, I have tried this sequence of commands:
1) Grant my custom account "log on as a service right":
ntrights +r SeServiceLogonRight -u teamcity@omnicorp
Windows confirms command worked successfully:
Granting SeServiceLogonRight to teamcity@omnicorp ... successful
2) Set service user account:
(Get-WmiObject Win32_Service -Filter "name='TCBuildAgent'").Change($Null,$Null,$Null,$Null,$Null,$Null,'teamcity@omnicorp','password')
...command fails with error 21:
__GENUS : 2
__CLASS : __PARAMETERS
__SUPERCLASS :
__DYNASTY : __PARAMETERS
__RELPATH :
__PROPERTY_COUNT : 1
__DERIVATION : {}
__SERVER :
__NAMESPACE :
__PATH :
ReturnValue : 21
PSComputerName :
Here's what I know so far:
- Error 21 translates to "Invalid parameters have been passed to the service."
- Username/password are valid - I know this because I am able to make this change via the services.msc snap-in
- Whenever I apply custom user manually, the above commands start to work (I have tested this on numerous fresh VMs).
- This tells me
ntrights
alone is not enough to allow domain account to be used a service user.
This is where I am stuck. All evidence suggests ntrights
is sufficient, but something is still missing.