[PUP-8939] Administrators are not able to run puppet agent when installed as SYSTEM in some cases - Puppet Tickets

Details

Template:
customfield_10700 260648
Acceptance Criteria:
- As an administrator I should be able to interactively run puppet agent no matter the original installation method.
Epic Link:
Windows NTFS and Permissions Improvements
Team:
Windows
Story Points:
1
Sprint:
Windows 2018-07-18, Windows 2018-07-25

CS Priority:
Normal
CS Frequency:
3 - 25-50% of Customers
CS Severity:
3 - Serious
CS Business Value:
4 - $$$$$
CS Impact:

Hide
Customers might assume that running puppet agent -t it would have the same result as a normal puppet daemon run, but it doesn't because puppet runs as LOCALSYSTEM when it's a daemon, but as the user calling it when it's run as puppet agent -t.

It would seem as though we want puppet to assign permissions to the LocalAdministrator group no matter which user it runs under(LOCALSYSTEM or a administrator) to avoid these oddities.

Show
Customers might assume that running puppet agent -t it would have the same result as a normal puppet daemon run, but it doesn't because puppet runs as LOCALSYSTEM when it's a daemon, but as the user calling it when it's run as puppet agent -t. It would seem as though we want puppet to assign permissions to the LocalAdministrator group no matter which user it runs under(LOCALSYSTEM or a administrator) to avoid these oddities.

This issue was created from the work in ~~PUP-6729~~

—

In some instances when Puppet Agent is installed as SYSTEM, the local administrators are unable to run puppet agent interactively.

relates to

PA-1165 Windows - pxp-agent.conf & server.cfg can only be accessed by local system account

PUP-9719 Cannot run Puppet Agent as Administrator if first PA run is done as System

BKR-1478 beaker-pe should not backup the client_data directory

PA-910 windows agent permission errors

PA-2019 Privilege escalation via %ProgramData%\PuppetLabs on Windows

PUP-7793 Puppet agent replacing transactionstore.yaml on first run after boot

PUP-9106 Windows file system ACLs should always write SYSTEM: (F)

PUP-8771 Write integration/acceptance tests for NTFS permissions for PUP-6729

PUP-6729 NTFS permissions should be recalculated given SYSTEM is an implicit member of local Administrators

PUP-9068 Windows admin? check should consider group membership

PUP-5491 The "client_data" Directory Permissions Incorrect After Installation

PUP-266 Allow puppet to manage owner & group file settings (Redmine 18342)

PUP-4684 windows file resource doesn't grant group full permissions

(8 relates to)