Win Upgrade (5.1.4 to 5.1.5) Fails When Agent Service User is Not Privileged

Just FYI, the TeamCity Server Upgrade from 5.1.4 to to 5.1.5 (and other versions I'm betting) fails miserably for Agents that do not run as Local System or as a user that is not in the administrators group. I run my Agent service is a non-privileged user (who has full control over the build directory) and I received this error in the build agent's upgrade logs:

[2010-10-20 21:47:55,567]   INFO - r.agent.upgrade.UpgradeRunBase - Run command line (arguments separated with '|'): cmd.exe|/c|C:\teamcity\build\bin\service.start.bat| (at C:\teamcity\build\bin)
[2010-10-20 21:47:55,614]   INFO - .agent.run.ProcessOutputLogger -  
[2010-10-20 21:47:55,614]   INFO - .agent.run.ProcessOutputLogger - C:\teamcity\build\bin>..\launcher\bin\TeamCityAgentService-windows-x86-32.exe -t ../conf/wrapper.conf  
[2010-10-20 21:47:55,630]   INFO - .agent.run.ProcessOutputLogger - wrapper  | OpenSCManager failed - Access is denied. (0x5)
[2010-10-20 21:47:55,646]  ERROR - r.agent.upgrade.UpgradeRunBase - Failed to start agent after upgrade: java.io.IOException: Failed to start process. Return code was 1 not equal to zero.
java.io.IOException: Failed to start process. Return code was 1 not equal to zero.
 at jetbrains.buildServer.agent.upgrade.UpgradeRunBase.runCmdLine(UpgradeRunBase.java:96)
 at jetbrains.buildServer.agent.upgrade.NTServiceUpgrade.exec(NTServiceUpgrade.java:38)
 at jetbrains.buildServer.agent.upgrade.NTServiceUpgrade.startAgain(NTServiceUpgrade.java:28)
 at jetbrains.buildServer.agent.upgrade.UpgradeRunBase.run(UpgradeRunBase.java:46)
 at jetbrains.buildServer.agent.upgrade.UpgradeMode$2.run(UpgradeMode.java:26)
 at jetbrains.buildServer.agent.upgrade.Upgrade2.main2(Upgrade2.java:34)
 at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
 at java.lang.reflect.Method.invoke(Unknown Source)
 at jetbrains.buildServer.agent.ClazzLoader.call(ClazzLoader.java:59)
 at jetbrains.buildServer.agent.ClazzLoader.callMain2(ClazzLoader.java:19)
 at jetbrains.buildServer.agent.upgrade.Upgrade.main(Upgrade.java:16)



Based on my research this is what happens when a non-administrator tries to invoke the OpenSCManager method. Because its the Agent's service process owner that performs the upgrade (in this case, the non-privileged user), the upgrade fails. On that note, if you also run the Server Service as a non-privileged user, the "upgrade" as we'll call it fully removed the old service and installs the new one AS LOCAL SYSTEM. So much for encouraging administrators to run the TeamCity services as non-LocalSystem users. The upgrade process reverts this. And it fails for the agent.

I temporarily added the agent's service user to the local administrators group, restarted the service, and it upgraded. Then I stopped the agent, removed it's service user from the administrators group, restarted the service, and all was well in hoo ville.
2 comments

Thank you for the report and investigations, I created issue in our tracker: http://youtrack.jetbrains.net/issue/TW-13914


0
I run my Agent service is a non-privileged user (who has full control over the build directory)

This might be not enough to perform agent upgrade. See details in the doc section.

0

Please sign in to leave a comment.