2

I am writing a puppet script to automate creation of TeamCity agents on Windows 2008 R2 SP2.
For this, I need to set a custom TeamCity service user account via command-line.

So far, I have tried this sequence of commands:

1) Grant my custom account "log on as a service right":

ntrights +r SeServiceLogonRight -u teamcity@omnicorp

Windows confirms command worked successfully:

Granting SeServiceLogonRight to teamcity@omnicorp ... successful

2) Set service user account:

(Get-WmiObject Win32_Service -Filter "name='TCBuildAgent'").Change($Null,$Null,$Null,$Null,$Null,$Null,'teamcity@omnicorp','password')

...command fails with error 21:

__GENUS : 2
__CLASS : __PARAMETERS
__SUPERCLASS :
__DYNASTY : __PARAMETERS
__RELPATH :
__PROPERTY_COUNT : 1
__DERIVATION : {}
__SERVER :
__NAMESPACE :
__PATH :
ReturnValue : 21
PSComputerName :

Here's what I know so far:

  • Error 21 translates to "Invalid parameters have been passed to the service."
  • Username/password are valid - I know this because I am able to make this change via the services.msc snap-in
  • Whenever I apply custom user manually, the above commands start to work (I have tested this on numerous fresh VMs).
  • This tells me ntrights alone is not enough to allow domain account to be used a service user.

This is where I am stuck. All evidence suggests ntrights is sufficient, but something is still missing.

2

You can try this :

(Get-WmiObject Win32_Service -Filter "name='TCBuildAgent'").Change($Null,$Null,$Null,$Null,$Null,$False,'teamcity@omnicorp','password')

The 6th parameter correspond to "DesktopInteract", and normally, the service cannot be granted rights to interact with the desktop, unless it is the Local System account.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.