Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title Kate Medred updated an issue Puppet / PUP-9719 Cannot run Puppet Agent as Administrator if first PA run is done as System Change By: Kate Medred Labels: resolved-issue-added Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.310162.1558726819000.28305.1582045682275%40Atlassian.JIRA.
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title Luchian Nemes updated an issue Puppet / PUP-9719 Cannot run Puppet Agent as Administrator if first PA run is done as System Change By: Luchian Nemes Fix Version/s: PUP 6.13.0 Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.310162.1558726819000.24805.1581604141415%40Atlassian.JIRA.
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title Gheorghe Popescu updated an issue Puppet / PUP-9719 Cannot run Puppet Agent as Administrator if first PA run is done as System Change By: Gheorghe Popescu Release Notes Summary: If the first Puppet Agent run was is done under SYSTEM account, following runs done by Administrator users were failing to send the report to master due to insufficient file permissions caused by the implementation of `Puppet::Util.replace_file`.Puppet now uses the new `Puppet::FileSystem.replace_file` method which correctly handles files permissions on Windows. Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.310162.1558726819000.2550.1580208540679%40Atlassian.JIRA.
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title Gheorghe Popescu updated an issue Puppet / PUP-9719 Cannot run Puppet Agent as Administrator if first PA run is done as System Change By: Gheorghe Popescu Release Notes Summary: If the first Puppet Agent run was done under SYSTEM account, following runs done by Administrator users were failing to send the report to master due to insufficient file permissions caused by the implementation of `Puppet::Util . replace_file`. Changed puppet to use Puppet now uses the new `Puppet::FileSystem.replace_file` method which correctly handles files permissionson Windows. Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.310162.1558726819000.2532.1580208480319%40Atlassian.JIRA.
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title Gheorghe Popescu updated an issue Puppet / PUP-9719 Cannot run Puppet Agent as Administrator if first PA run is done as System Change By: Gheorghe Popescu Release Notes Summary: If the first Puppet Agent run was done under SYSTEM account, following runs done by Administrator users were failing to send the report to master.Changed puppet to use `Puppet::FileSystem.replace_file` which correctly handles files permissions Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.310162.1558726819000.2521.1580208420584%40Atlassian.JIRA.
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title Gheorghe Popescu updated an issue Puppet / PUP-9719 Cannot run Puppet Agent as Administrator if first PA run is done as System Change By: Gheorghe Popescu Release Notes Summary: If the first Puppet Agent run was done under SYSTEM account, following runs done by Administrator users were failing to send the report to master.Changed puppet to use Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.310162.1558726819000.2515.1580208360676%40Atlassian.JIRA.
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title Gheorghe Popescu updated an issue Puppet / PUP-9719 Cannot run Puppet Agent as Administrator if first PA run is done as System Change By: Gheorghe Popescu Release Notes Summary: TBD - Will provide these If the first Puppet Agent run was done under SYSTEM account, following Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.310162.1558726819000.2501.1580208240648%40Atlassian.JIRA.
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title Josh Cooper commented on PUP-9719 Re: Cannot run Puppet Agent as Administrator if first PA run is done as System To reproduce: require 'puppet' require 'puppet/util/windows' class Tester include Puppet::Util::Windows::Security def replace_file(path, mode) if Puppet::FileSystem.exist?(path) Puppet::FileSystem.unlink(path) end Puppet::FileSystem.touch(path) dacl = Puppet::Util::Windows::AccessControlList.new
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title Josh Cooper commented on PUP-9719 Re: Cannot run Puppet Agent as Administrator if first PA run is done as System The root cause of this issue is a bug/unspecified behavior in Puppet::Util::Windows::Security.set_mode when replacing a file containing access control entries whose SID is neither the file owner, group nor everyone. The legacy Puppet::Util.replace_file method relies on the ReplaceFile Windows API to atomically replace a file while preserving the security descriptor for the target file. However, if the file doesn't exist yet, puppet touches the target file, calls set_mode on it, and then calls ReplaceFileW. When running puppet as a scheduled task, the newly touched file has the following permissions due to the default DACL for the process that launches puppet: Owner: NT AUTHORITY\SYSTEM Group: NT AUTHORITY\SYSTEM NT AUTHORITY\SYSTEM:(I) 0x1f01ff BUILTIN\Administrators:(I)0x1f01ff After creating the file, puppet calls set_mode on it. Since Administrators is neither the owner or group, the ACE is removed! Owner: NT AUTHORITY\SYSTEM Group: NT AUTHORITY\SYSTEM NT AUTHORITY\SYSTEM: 0x1f01ff Everyone: 0x120080
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title Mihai Buzgau updated an issue Puppet / PUP-9719 Cannot run Puppet Agent as Administrator if first PA run is done as System Change By: Mihai Buzgau Sprint: PR - 2019-06-25, PR - 2019-07-10, PR - 2019-07-23, NW - 2019-08-07, NW - 2019-08-21, NW - 2019-09-03, NW - 2019-09-18, NW - 2019-10-02, NW - 2019-10-16, NW - 2019-10-30, NW - 2019-11-13, 2019-11-27, 2019-12-11, 2019-12-24, NW - 2020-01-22 , NW - 2020-02-05 Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.310162.1558726819000.31649.1579685944555%40Atlassian.JIRA.
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title Mihai Buzgau updated an issue Puppet / PUP-9719 Cannot run Puppet Agent as Administrator if first PA run is done as System Change By: Mihai Buzgau Sprint: PR - 2019-06-25, PR - 2019-07-10, PR - 2019-07-23, NW - 2019-08-07, NW - 2019-08-21, NW - 2019-09-03, NW - 2019-09-18, NW - 2019-10-02, NW - 2019-10-16, NW - 2019-10-30, NW - 2019-11-13, 2019-11-27, 2019-12-11, 2019-12-24 , NW - 2020-01-22 Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.310162.1558726819000.13827.1578389161060%40Atlassian.JIRA.
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title Mihai Buzgau updated an issue Puppet / PUP-9719 Cannot run Puppet Agent as Administrator if first PA run is done as System Change By: Mihai Buzgau Sprint: PR - 2019-06-25, PR - 2019-07-10, PR - 2019-07-23, NW - 2019-08-07, NW - 2019-08-21, NW - 2019-09-03, NW - 2019-09-18, NW - 2019-10-02, NW - 2019-10-16, NW - 2019-10-30, NW - 2019-11-13, 2019-11-27, 2019-12-11 , 2019-12-24 Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.310162.1558726819000.3824.1576056780511%40Atlassian.JIRA.
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title Mihai Buzgau updated an issue Puppet / PUP-9719 Cannot run Puppet Agent as Administrator if first PA run is done as System Change By: Mihai Buzgau Sprint: PR - 2019-06-25, PR - 2019-07-10, PR - 2019-07-23, NW - 2019-08-07, NW - 2019-08-21, NW - 2019-09-03, NW - 2019-09-18, NW - 2019-10-02, NW - 2019-10-16, NW - 2019-10-30, NW - 2019-11-13, 2019-11-27 , 2019-12-11 Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.310162.1558726819000.47060.1574848264585%40Atlassian.JIRA.
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title Mihai Buzgau updated an issue Puppet / PUP-9719 Cannot run Puppet Agent as Administrator if first PA run is done as System Change By: Mihai Buzgau Sprint: PR - 2019-06-25, PR - 2019-07-10, PR - 2019-07-23, NW - 2019-08-07, NW - 2019-08-21, NW - 2019-09-03, NW - 2019-09-18, NW - 2019-10-02, NW - 2019-10-16, NW - 2019-10-30, NW - 2019-11-13 , 2019-11-27 Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.310162.1558726819000.32026.1573727283082%40Atlassian.JIRA.
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title Mihai Buzgau updated an issue Puppet / PUP-9719 Cannot run Puppet Agent as Administrator if first PA run is done as System Change By: Mihai Buzgau Sprint: PR - 2019-06-25, PR - 2019-07-10, PR - 2019-07-23, NW - 2019-08-07, NW - 2019-08-21, NW - 2019-09-03, NW - 2019-09-18, NW - 2019-10-02, NW - 2019-10-16, NW - 2019-10-30 , NW - 2019-11-13 Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.310162.1558726819000.12167.1572426004363%40Atlassian.JIRA.
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title Mihai Buzgau updated an issue Puppet / PUP-9719 Cannot run Puppet Agent as Administrator if first PA run is done as System Change By: Mihai Buzgau Sprint: PR - 2019-06-25, PR - 2019-07-10, PR - 2019-07-23, NW - 2019-08-07, NW - 2019-08-21, NW - 2019-09-03, NW - 2019-09-18, NW - 2019-10-02, NW - 2019-10-16 , NW - 2019-10-30 Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.310162.1558726819000.2279.1571214245785%40Atlassian.JIRA.
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title Mihai Buzgau updated an issue Puppet / PUP-9719 Cannot run Puppet Agent as Administrator if first PA run is done as System Change By: Mihai Buzgau Sprint: PR - 2019-06-25, PR - 2019-07-10, PR - 2019-07-23, NW - 2019-08-07, NW - 2019-08-21, NW - 2019-09-03, NW - 2019-09-18, NW - 2019-10-02 , NW - 2019-10-16 Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.310162.1558726819000.124678.1570005606294%40Atlassian.JIRA.
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title Mihai Buzgau updated an issue Puppet / PUP-9719 Cannot run Puppet Agent as Administrator if first PA run is done as System Change By: Mihai Buzgau Sprint: PR - 2019-06-25, PR - 2019-07-10, PR - 2019-07-23, NW - 2019-08-07, NW - 2019-08-21, NW - 2019-09-03, NW - 2019-09-18 , NW - 2019-10-02 Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.310162.1558726819000.103571.1568815983471%40Atlassian.JIRA.
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title Mihai Buzgau updated an issue Puppet / PUP-9719 Cannot run Puppet Agent as Administrator if first PA run is done as System Change By: Mihai Buzgau Sprint: PR - 2019-06-25, PR - 2019-07-10, PR - 2019-07-23, NW - 2019-08-07, NW - 2019-08-21, NW - 2019-09-03 , NW - 2019-09-18 Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.310162.1558726819000.84528.1567588623310%40Atlassian.JIRA.
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title Mihai Buzgau updated an issue Puppet / PUP-9719 Cannot run Puppet Agent as Administrator if first PA run is done as System Change By: Mihai Buzgau Sprint: PR - 2019-06-25, PR - 2019-07-10, PR - 2019-07-23, NW - 2019-08-07, NW - 2019-08-21 , NW - 2019-09-03 Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.310162.1558726819000.65389.1566379023921%40Atlassian.JIRA.
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title Mihai Buzgau assigned an issue to Gheorghe Popescu Puppet / PUP-9719 Cannot run Puppet Agent as Administrator if first PA run is done as System Change By: Mihai Buzgau Assignee: John O'Connor Gheorghe Popescu Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.310162.1558726819000.62562.1566308760353%40Atlassian.JIRA.
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title John O'Connor commented on PUP-9719 Re: Cannot run Puppet Agent as Administrator if first PA run is done as System PR is pending merge that addresses the issue. Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.310162.1558726819000.50239.1565375580338%40Atlassian.JIRA.
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title John O'Connor updated an issue Puppet / PUP-9719 Cannot run Puppet Agent as Administrator if first PA run is done as System Change By: John O'Connor Release Notes Summary: TBD - Will provide these Release Notes: Bug Fix Acceptance Criteria: TBD Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.310162.1558726819000.50230.1565375520436%40Atlassian.JIRA.
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title Mihai Buzgau updated an issue Puppet / PUP-9719 Cannot run Puppet Agent as Administrator if first PA run is done as System Change By: Mihai Buzgau Sprint: PR - 2019-06-25, PR - 2019-07-10, PR - 2019-07-23, NW - 2019-08-07 , NW - 2019-08-21 Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.310162.1558726819000.46002.1565167084077%40Atlassian.JIRA.
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title Mihai Buzgau updated an issue Puppet / PUP-9719 Cannot run Puppet Agent as Administrator if first PA run is done as System Change By: Mihai Buzgau Sprint: PR - 2019-06-25, PR - 2019-07-10, PR - 2019-07-23 , NW - 2019-08-07 Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.310162.1558726819000.28542.1563957064790%40Atlassian.JIRA.
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title Mihai Buzgau updated an issue Puppet / PUP-9719 Cannot run Puppet Agent as Administrator if first PA run is done as System Change By: Mihai Buzgau Sprint: PR - 2019-06-25, PR - 2019-07-10 , PR - 2019-07-23 Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.310162.1558726819000.10088.1562746265694%40Atlassian.JIRA. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title
John O'Connor updated an issue
Puppet / PUP-9719
Cannot run Puppet Agent as Administrator if first PA run is done as System
Change By:
John O'Connor
*Puppet Version:* 6.4.2 *Puppet Server Version:* N/A *OS Name/Version:* Windows Server 2016 x64When installing Puppet Agent (6.4.2/PE 2019.1.0) on Server 2016 using a Powershell script running as the SYSTEM account, Administrator users can't run Puppet. Daemon/service runs are performed as expected. Direct Puppet runs appear to occur but no report is sent to the master. *UPDATE* - It the first Run as SYSTEM that is the problem - so have changed ticket title.PUP-8939 had reportedly solved this issue.*Desired Behavior:**note* - so far, this can only be replicated using scheduled tasks as {{psexec}} doesn't provide the same permissions environment : # Install: {{schtasks /create /tn PuppetInstall /RL HIGHEST /RU SYSTEM /F /SC ONCE /ST 11:15 /TR 'cmd /c c:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe -sta -WindowStyle Hidden -ExecutionPolicy Bypass -NonInteractive -NoProfile -File c:\puppet.ps1 >> C:\windows\temp\puppet-ins.log 2>&1'}} # Run PA {{schtasks /create /tn PuppetInstall /RL HIGHEST /RU SYSTEM /F /SC ONCE /ST 11:17 /TR 'cmd /c c:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe -sta -WindowStyle Hidden -ExecutionPolicy Bypass -NonInteractive -NoProfile -File c:\puppetrun.ps1 >> C:\windows\temp\puppet-run.log 2>&1'}} # Populate csr_attributes.yml and {{server}} in the agent config as necessary. # As an Administrator, run {{puppet agent --test}} on the newly installed agent. See [https://gist.github.com/jcoconnor/79767ef986a3ec600de0cd84ec4ea600] for example {{puppet-ins.ps1}} and {{puppet-run.ps1}} scripts. *Actual Behavior:*Catalog retrieval fails; log has been redacted:{code}2019-05-21 17:20:36 -0400 Puppet (debug): HTTP POST https://compiler.example.net:8140/puppet/v3/catalog/examplenode.example.net returned 200 OK2019-05-21 17:20:36 -0400 Puppet (debug): Caching connection for https://compiler.example.net:81402019-05-21 17:20:36 -0400 Puppet (info): Caching catalog for examplenode.example.net2019-05-21 17:20:38 -0400 Puppet (err): ReplaceFile(C:/ProgramData/PuppetLabs/puppet/cache/client_data/catalog/examplenode.example.net.json, C:/ProgramData/PuppetLabs/puppet/cache/client_data/catalog/examplenode.example.net.json20190521-6580-blokpv): Access is denied. c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/util/windows/file.rb:89:in `replace_file'c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/util.rb:636:in `replace_file'c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/indirector/json.rb:17:in `save'c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/indirector/indirection.rb:200:in `find'c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/configurer.rb:466:in `block in retrieve_new_catalog'c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/util.rb:518:in `block in thinmark'c:/P
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title
John O'Connor updated an issue
Puppet / PUP-9719
Cannot run Puppet Agent as Administrator if first PA run is done as System
Change By:
John O'Connor
*Puppet Version:* 6.4.2 *Puppet Server Version:* N/A *OS Name/Version:* Windows Server 2016 x64When installing Puppet Agent (6.4.2/PE 2019.1.0) on Server 2016 using a Powershell script running as the SYSTEM account, Administrator users can't run Puppet. Daemon/service runs are performed as expected. Direct Puppet runs appear to occur but no report is sent to the master. *UPDATE* - It the first Run as SYSTEM that is the problem - so have changed ticket title.PUP-8939 had reportedly solved this issue.*Desired Behavior:**note* - so far, this can only be replicated using scheduled tasks as {{psexec}} doesn't provide the same permissions environment : 1. # Install: {{schtasks /create /tn PuppetInstall /RL HIGHEST /RU SYSTEM /F /SC ONCE /ST 11:15 /TR 'cmd /c c:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe -sta -WindowStyle Hidden -ExecutionPolicy Bypass -NonInteractive -NoProfile -File c:\puppet.ps1 >> C:\windows\temp\puppet-ins.log 2>&1'}} 2. # Run PA {{schtasks /create /tn PuppetInstall /RL HIGHEST /RU SYSTEM /F /SC ONCE /ST 11:17 /TR 'cmd /c c:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe -sta -WindowStyle Hidden -ExecutionPolicy Bypass -NonInteractive -NoProfile -File c:\puppetrun.ps1 >> C:\windows\temp\puppet-run.log 2>&1'}} 1. Download the Agent 6.4.2 x64 MSI to a temp path (in this example, {{C:\temp\puppet\puppet-agent-x64.msi}}). 2. Install Puppet Agent on a Server 2016 node as the SYSTEM user by running {{start-process -filepath "msiexec.exe" -arg "/qn /norestart /l*v C:\windows\temp\puppetinstall.log /i c:\temp\puppet\puppet-agent-x64.msi PUPPET_AGENT_STARTUP_MODE=Manual" -Wait}} 3. # Populate csr_attributes.yml and {{server}} in the agent config as necessary. 4. # As an Administrator, run {{puppet agent --test}} on the newly installed agent. *Actual Behavior:*Catalog retrieval fails; log has been redacted:{code}2019-05-21 17:20:36 -0400 Puppet (debug): HTTP POST https://compiler.example.net:8140/puppet/v3/catalog/examplenode.example.net returned 200 OK2019-05-21 17:20:36 -0400 Puppet (debug): Caching connection for https://compiler.example.net:81402019-05-21 17:20:36 -0400 Puppet (info): Caching catalog for examplenode.example.net2019-05-21 17:20:38 -0400 Puppet (err): ReplaceFile(C:/ProgramData/PuppetLabs/puppet/cache/client_data/catalog/examplenode.example.net.json, C:/ProgramData/PuppetLabs/puppet/cache/client_data/catalog/examplenode.example.net.json20190521-6580-blokpv): Access is denied. c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/util/windows/file.rb:89:in `replace_file'c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/util.rb:636:in `replace_file'c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/indirector/json.rb:17:in `save'c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/indirector/indir
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title
John O'Connor updated an issue
Puppet / PUP-9719
Cannot run Puppet Agent as Administrator if first PA run is done as System
Change By:
John O'Connor
*Puppet Version:* 6.4.2 *Puppet Server Version:* N/A *OS Name/Version:* Windows Server 2016 x64When installing Puppet Agent (6.4.2/PE 2019.1.0) on Server 2016 using a Powershell script running as the SYSTEM account, Administrator users can't run Puppet. Daemon/service runs are performed as expected. Direct Puppet runs appear to occur but no report is sent to the master. *UPDATE* - It the first Run as SYSTEM that is the problem - so have changed ticket title.PUP-8939 had reportedly solved this issue.*Desired Behavior:**note* - so far, this can only be replicated using scheduled tasks as {{psexec}} doesn't provide the same permissions environment :1. Install: TBD {{schtasks /create /tn PuppetInstall /RL HIGHEST /RU SYSTEM /F /SC ONCE /ST 11:15 /TR 'cmd /c c:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe -sta -WindowStyle Hidden -ExecutionPolicy Bypass -NonInteractive -NoProfile -File c:\puppet.ps1 >> C:\windows\temp\puppet-ins.log 2>&1'}} 2. Run PA {{ TBD schtasks /create /tn PuppetInstall /RL HIGHEST /RU SYSTEM /F /SC ONCE /ST 11:17 /TR 'cmd /c c:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe -sta -WindowStyle Hidden -ExecutionPolicy Bypass -NonInteractive -NoProfile -File c:\puppetrun.ps1 >> C:\windows\temp\puppet-run.log 2>&1' }} 1. Download the Agent 6.4.2 x64 MSI to a temp path (in this example, {{C:\temp\puppet\puppet-agent-x64.msi}}). 2. Install Puppet Agent on a Server 2016 node as the SYSTEM user by running {{start-process -filepath "msiexec.exe" -arg "/qn /norestart /l*v C:\windows\temp\puppetinstall.log /i c:\temp\puppet\puppet-agent-x64.msi PUPPET_AGENT_STARTUP_MODE=Manual" -Wait}} 3. Populate csr_attributes.yml and {{server}} in the agent config as necessary. 4. As an Administrator, run {{puppet agent --test}} on the newly installed agent.*Actual Behavior:*Catalog retrieval fails; log has been redacted:{code}2019-05-21 17:20:36 -0400 Puppet (debug): HTTP POST https://compiler.example.net:8140/puppet/v3/catalog/examplenode.example.net returned 200 OK2019-05-21 17:20:36 -0400 Puppet (debug): Caching connection for https://compiler.example.net:81402019-05-21 17:20:36 -0400 Puppet (info): Caching catalog for examplenode.example.net2019-05-21 17:20:38 -0400 Puppet (err): ReplaceFile(C:/ProgramData/PuppetLabs/puppet/cache/client_data/catalog/examplenode.example.net.json, C:/ProgramData/PuppetLabs/puppet/cache/client_data/catalog/examplenode.example.net.json20190521-6580-blokpv): Access is denied. c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/util/windows/file.rb:89:in `replace_file'c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/util.rb:636:in `replace_file'c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/indirector/json.rb:17:in `save'c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/indirector/indirection.rb
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title
John O'Connor updated an issue
Puppet / PUP-9719
Cannot run Puppet Agent as Administrator if first PA run is done as System
Change By:
John O'Connor
*Puppet Version:* 6.4.2 *Puppet Server Version:* N/A *OS Name/Version:* Windows Server 2016 x64When installing Puppet Agent (6.4.2/PE 2019.1.0) on Server 2016 using a Powershell script running as the SYSTEM account, Administrator users can't run Puppet. Daemon/service runs are performed as expected. Direct Puppet runs appear to occur but no report is sent to the master. *UPDATE* - It the first Run as SYSTEM that is the problem - so have changed ticket title.PUP-8939 had reportedly solved this issue.*Desired Behavior:**note* - so far, this can only be replicated using scheduled tasks as {{psexec}} doesn't provide the same permissions environment :1. Install: {{psexec -s -i "msiexec.exe" /qn /norestart /l*v C:\windows\temp\puppetinstall.log /i C:\Users\Administrator\Downloads\puppet-agent-6.4.2-x64.msi PUPPET_AGENT_STARTUP_MODE=Manual}} TBD 2. Run PA {{ psexec -s "C:\Program Files\Puppet Labs\Puppet\bin\puppet.bat" agent -t TBD }} 1. Download the Agent 6.4.2 x64 MSI to a temp path (in this example, {{C:\temp\puppet\puppet-agent-x64.msi}}). 2. Install Puppet Agent on a Server 2016 node as the SYSTEM user by running {{start-process -filepath "msiexec.exe" -arg "/qn /norestart /l*v C:\windows\temp\puppetinstall.log /i c:\temp\puppet\puppet-agent-x64.msi PUPPET_AGENT_STARTUP_MODE=Manual" -Wait}} 3. Populate csr_attributes.yml and {{server}} in the agent config as necessary. 4. As an Administrator, run {{puppet agent --test}} on the newly installed agent.*Actual Behavior:*Catalog retrieval fails; log has been redacted:{code}2019-05-21 17:20:36 -0400 Puppet (debug): HTTP POST https://compiler.example.net:8140/puppet/v3/catalog/examplenode.example.net returned 200 OK2019-05-21 17:20:36 -0400 Puppet (debug): Caching connection for https://compiler.example.net:81402019-05-21 17:20:36 -0400 Puppet (info): Caching catalog for examplenode.example.net2019-05-21 17:20:38 -0400 Puppet (err): ReplaceFile(C:/ProgramData/PuppetLabs/puppet/cache/client_data/catalog/examplenode.example.net.json, C:/ProgramData/PuppetLabs/puppet/cache/client_data/catalog/examplenode.example.net.json20190521-6580-blokpv): Access is denied. c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/util/windows/file.rb:89:in `replace_file'c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/util.rb:636:in `replace_file'c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/indirector/json.rb:17:in `save'c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/indirector/indirection.rb:200:in `find'c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/configurer.rb:466:in `block in retrieve_new_catalog'c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/util.rb:518:in `block in thinmark'c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/2.5.0/benchmark.rb:308:in `realt
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title
John O'Connor updated an issue
Puppet / PUP-9719
Cannot run Puppet Agent as Administrator if first PA run is done as System
Change By:
John O'Connor
*Puppet Version:* 6.4.2 *Puppet Server Version:* N/A *OS Name/Version:* Windows Server 2016 x64When installing Puppet Agent (6.4.2/PE 2019.1.0) on Server 2016 using a Powershell script running as the SYSTEM account, Administrator users can't run Puppet. Daemon/service runs are performed as expected. Direct Puppet runs appear to occur but no report is sent to the master.*UPDATE* - It the first Run as SYSTEM that is the problem - so have changed ticket title.PUP-8939 had reportedly solved this issue.*Desired Behavior:**note* - you need to use so far, this can only be replicated using scheduled tasks as {{psexec -s }} to repro this on {{vmpooler}} nodes to ensure doesn't provide the SYSTEM account is used same permissions environment :1. Install: {{psexec -s -i "msiexec.exe" /qn /norestart /l*v C:\windows\temp\puppetinstall.log /i C:\Users\Administrator\Downloads\puppet-agent-6.4.2-x64.msi PUPPET_AGENT_STARTUP_MODE=Manual}}2. Run PA {{psexec -s "C:\Program Files\Puppet Labs\Puppet\bin\puppet.bat" agent -t}} 1. Download the Agent 6.4.2 x64 MSI to a temp path (in this example, {{C:\temp\puppet\puppet-agent-x64.msi}}). 2. Install Puppet Agent on a Server 2016 node as the SYSTEM user by running {{start-process -filepath "msiexec.exe" -arg "/qn /norestart /l*v C:\windows\temp\puppetinstall.log /i c:\temp\puppet\puppet-agent-x64.msi PUPPET_AGENT_STARTUP_MODE=Manual" -Wait}} 3. Populate csr_attributes.yml and {{server}} in the agent config as necessary. 4. As an Administrator, run {{puppet agent --test}} on the newly installed agent.*Actual Behavior:*Catalog retrieval fails; log has been redacted:{code}2019-05-21 17:20:36 -0400 Puppet (debug): HTTP POST https://compiler.example.net:8140/puppet/v3/catalog/examplenode.example.net returned 200 OK2019-05-21 17:20:36 -0400 Puppet (debug): Caching connection for https://compiler.example.net:81402019-05-21 17:20:36 -0400 Puppet (info): Caching catalog for examplenode.example.net2019-05-21 17:20:38 -0400 Puppet (err): ReplaceFile(C:/ProgramData/PuppetLabs/puppet/cache/client_data/catalog/examplenode.example.net.json, C:/ProgramData/PuppetLabs/puppet/cache/client_data/catalog/examplenode.example.net.json20190521-6580-blokpv): Access is denied. c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/util/windows/file.rb:89:in `replace_file'c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/util.rb:636:in `replace_file'c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/indirector/json.rb:17:in `save'c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/indirector/indirection.rb:200:in `find'c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/configurer.rb:466:in `block in retrieve_new_catalog'c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/util.rb:518:in `block in thinmark'c
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title Mihai Buzgau updated an issue Puppet / PUP-9719 Cannot run Puppet Agent as Administrator if first PA run is done as System Change By: Mihai Buzgau Sprint: PR - 2019-06-25 , PR - 2019-07-10 Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.310162.1558726819000.61556.1561554245894%40Atlassian.JIRA. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title
John O'Connor commented on PUP-9719
Re: Cannot run Puppet Agent as Administrator if first PA run is done as System
The following is a crude script that will Fix permissions - it can be run either in the puppetrun.ps1 script or prior to using puppet agent -t as Administrator
# Script to find and fix files under C:\ProgramData\PuppetLabs that don't have
# Administrator Rights.
$Folder = "C:\ProgramData\PuppetLabs"
$AccessAdminRule = New-Object System.Security.AccessControl.FileSystemAccessRule("BUILTIN\Administrators", "Full", "Allow")
Get-ChildItem -Path "$Folder" -Recurse |
where {$_.PSIsContainer -eq $False } |
ForEach-Object {get-acl -path $_.Fullname} |
where { $_.AccessToString -notMatch "Administrators"} | ForEach-Object {
Write-Output "Working on $($_.Path)"
Write-Output "Access to String $($_.AccesstoString)"
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title Ethan Brown commented on PUP-9719 Re: Cannot run Puppet Agent as Administrator if first PA run is done as System Be careful when referring to Administrator We typically don't want Administrator (the user), we want to apply Administrators (the group). Administrators has a well known SID of S-1-5-32-544 and includes the users we typically wish to grant access to - Administrator, SYSTEM, domain admins, etc. Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.310162.1558726819000.59788.1561481160862%40Atlassian.JIRA. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title John O'Connor commented on PUP-9719 Re: Cannot run Puppet Agent as Administrator if first PA run is done as System The issue is the first Puppet Agent run regardless of whether System or Administrator was used to install, so again - it looks to be a Puppet Agent issue and not an MSI installer issue. Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.310162.1558726819000.57800.1561388340271%40Atlassian.JIRA. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title John O'Connor updated an issue Puppet / PUP-9719 Cannot run Puppet Agent as Administrator if first PA run is done as System Change By: John O'Connor Summary: Can't Cannot run puppet agent after installing the MSI using the SYSTEM account Puppet Agent as Administrator if first PA run is done as System Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.310162.1558726819000.57791.1561388281177%40Atlassian.JIRA. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-9719) Cannot run Puppet Agent as Administrator if first PA run is done as System
Title: Message Title
John O'Connor updated an issue
Puppet / PUP-9719
Cannot run Puppet Agent as Administrator if first PA run is done as System
Change By:
John O'Connor
*Puppet Version:* 6.4.2 *Puppet Server Version:* N/A *OS Name/Version:* Windows Server 2016 x64When installing Puppet Agent (6.4.2/PE 2019.1.0) on Server 2016 using a Powershell script running as the SYSTEM account, Administrator users can't run Puppet. Daemon/service runs are performed as expected. Direct Puppet runs appear to occur but no report is sent to the master. *UPDATE* - It the first Run as SYSTEM that is the problem - so have changed ticket title. PUP-8939 had reportedly solved this issue.*Desired Behavior:**note* - you need to use {{psexec -s}} to repro this on {{vmpooler}} nodes to ensure the SYSTEM account is used:1. Install: {{psexec -s -i "msiexec.exe" /qn /norestart /l*v C:\windows\temp\puppetinstall.log /i C:\Users\Administrator\Downloads\puppet-agent-6.4.2-x64.msi PUPPET_AGENT_STARTUP_MODE=Manual}}2. Run PA {{psexec -s "C:\Program Files\Puppet Labs\Puppet\bin\puppet.bat" agent -t}} 1. Download the Agent 6.4.2 x64 MSI to a temp path (in this example, {{C:\temp\puppet\puppet-agent-x64.msi}}). 2. Install Puppet Agent on a Server 2016 node as the SYSTEM user by running {{start-process -filepath "msiexec.exe" -arg "/qn /norestart /l*v C:\windows\temp\puppetinstall.log /i c:\temp\puppet\puppet-agent-x64.msi PUPPET_AGENT_STARTUP_MODE=Manual" -Wait}} 3. Populate csr_attributes.yml and {{server}} in the agent config as necessary. 4. As an Administrator, run {{puppet agent --test}} on the newly installed agent.*Actual Behavior:*Catalog retrieval fails; log has been redacted:{code}2019-05-21 17:20:36 -0400 Puppet (debug): HTTP POST https://compiler.example.net:8140/puppet/v3/catalog/examplenode.example.net returned 200 OK2019-05-21 17:20:36 -0400 Puppet (debug): Caching connection for https://compiler.example.net:81402019-05-21 17:20:36 -0400 Puppet (info): Caching catalog for examplenode.example.net2019-05-21 17:20:38 -0400 Puppet (err): ReplaceFile(C:/ProgramData/PuppetLabs/puppet/cache/client_data/catalog/examplenode.example.net.json, C:/ProgramData/PuppetLabs/puppet/cache/client_data/catalog/examplenode.example.net.json20190521-6580-blokpv): Access is denied. c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/util/windows/file.rb:89:in `replace_file'c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/util.rb:636:in `replace_file'c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/indirector/json.rb:17:in `save'c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/indirector/indirection.rb:200:in `find'c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/configurer.rb:466:in `block in retrieve_new_catalog'c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/vendor_ruby/puppet/util.rb:518:in `block in thinmark'c:/Program Files/Puppet Labs/Puppet/puppet/lib/ruby/2.5.0/benchmark.rb:308:in `realtime'c:/Program Files/Puppet La
