Bamboo Task throwing error when running under a specific User account

[daniel ramazani]

We have a large Bamboo Instance and we’ve been using the Powershell Plugin without issue for a long time.

Recently some our our users tried to use the Run As feature and noticed they can’t get it working.

The error that gets outputted isn’t helpful.

Failing task since return code of [D:\builds\2\600342557-599687337-599279227-PowerShellTask-18158453374250826.exe -c:D:\builds\2\600342557-599687337-599279227-PowerShellTask-5580541976567192619.tmp] was -1073741819 while expected 0

To troubleshoot the problem, I logged onto the Bamboo Agents and did a RunAs of the powershell cmd prompt as the user they were attempting to execute under.

I had no problem running the powershell script from the agent, so obvious filesystem permissions don’t seem to be the problem.

Also, if they put the wrong password into the Task then they get an error about invalid credentials instead of the generic one, so I know they have the username and password right.

Can you think of any other way I can troubleshoot this problem?

‌

[Sergey Podobry]

Hi Daniel!

Could you provide some additional info:

• what is OS version?
• is the agent running as service?
• under what user account the agent is running?
• are you using the latest PowerShell Task?

‌

[daniel ramazani]

1. The Agent is Windows Server 2016
2. Yes, its running as a service
3. I don’t want to share the specific service account name, but the Agent is running under one specific service account which is different from the service account that the team is trying to use
4. Yes, I’m on 1.2.2 of the Plugin, and our Bamboo Server version is 7.1.2

‌

[Sergey Podobry]

Ok, thank you. We’re investigating this.

[daniel ramazani]

Thanks you!! I can reproduce the issue in my UAT environment, so if you’d like me to try any crazy experimenst let me know!

I noticed that if I input the same account that runs the Bamboo Agent Service, then the RunAs feature works.

No real surprise there. This makes me think that the error is being caused by some folder permissions of some kind that the RunAs account needs just to execute the most basic of powershell commands.

Interestingly, I tried doing the RunAs for an account which has local admin on the Agent, and it failed.

That might not rule out folder permission. Even though the account is an admin, it could still be hitting UAC when it tries to access some resource.

I’ll probably try granting ownership to pieces of the Bamboo Agent plumbing on the Agent host to see if I can gather any evidence for my hypothesis.

Let me know if you have any other troubleshooting steps you’d like me to try.

[Sergey Podobry]

Unfortunately the issue is not as simple as it seems, so it will take some more time.

[daniel ramazani]

No problem. If you’d like to work with me via a coordinated session just let me know.

For now I’ll wait patiently for your response.

[Sergey Podobry]

Hi Daniel!

We’ve updated the RunAs engine and released a new version of the addon. Could you try the new version and post back results here?

[daniel ramazani]

You’re a genius

I installed this new version in our UAT environment and tried it. This is what I get now.

Text: Precondition failed (You should enable 'replace a process level token' privilege in group policies for the current user: ****)
Error: hasAssignPrimaryTokenPrivilege (PRECOND)
Source: CreateAsUserStrategy::create:19

HINT: It seems that the current user has no necessary privileges to run a process under another user. Go to a group policy editor and enable them.
Failing task since return code of [D:\builds\1\AD00000000-TES1-JOB1-32-PowerShellTask-1098285920415994961.exe runconfig D:\builds\1\AD00000000-TES1-JOB1-32-PowerShellTask-5530794359402940662.tmp] was 1 while expected 0

Googling this group policy explains what I need to do to get this working.

I need some time to get the permission to make this work, but I think its fair to say you can consider this ticket resolved.

I will report back in a week or two once I’m able to get it fully working.

[Sergey Podobry]

Ok, it seems we are on the right track!

[Sergey Podobry]

I'm assuming that everything is fine so I'm closing the issue.