0
votes

I am working on a TFS CI build pipeline. The build includes execution of functional UI tests (Run Functional Tests) and the required accompanying preparatory test agent deployment step (Deploy Test Agent).

This build executed successfully in the past but spontaneously stopped working recently.

I initially ran into difficulty with the DTA task executing hanging:

Task 'SetupTestMachineForUiTests' on machine '[testVM]:5985' is taking time. Please Wait

I had encountered this issue with this build task before albeit intermittently. However, this time the step would not complete no matter how many times it executed. Eventually (~20 minutes), the step crashed out with the following error:

Task 'SetupTestMachineForUiTests' for machine [testVM]:5985's Error : System.Exception: Stopping test machine setup as it exceeded maximum number of reboots. If you are running test agent in interactive mode, please make sure that autologon is enabled and no legal notice is displayed on logon in test machines.

Unfortunately, the DTA task only writes logs to the usual location on the test VM when the DTAExecutionHost.exe is manually closed on the server after the step has failed. The logs offer no clue as to what the problem might be.

One of the prerequisites for the DTA step to execute successfully is that AutoLogon is enabled on the test VM; I had done this with a simple PowerShell script, executed prior to the DTA task. In order to confirm that the test VM registry values had been correctly assigned (to enable auto logon, disable legal notice, screensaver etc) during my PowerShell script execution, I added a further PowerShell debug script to the build to output each relevant registry value to the build console (all are correctly assigned).

However, when I went to test remote login on the test VM, using the test username, the user creds are accepted but the following warning message shows:

To sign in remotely, you need the right to sign in through Remote Desktop Services. By default members of the Administrators group have this right. If the group you're in does not have the right, or if the right has been removed from the Administrators group, you need to be granted the right manually.

I believe this is the problem. However, the solution has so far eluded me.

  • I double- and triple- checked; the test user has been added to the Remote Desktop Users group (also Administrators group).
  • I've also confirmed that both Administrators and Remote Desktop Users groups have been granted 'Allow log on through Remote Desktop Services' user rights.
  • In testing, I forced successful execution of the build by substituting my own username instead of the test user into the build definition (my user name is also added to RDU and Admin user groups on the server but I can successfully remote onto the box with my own creds); this build executed successfully.

I also inspected the other (possibly, probably) related user groups:

  • Srv_SeDenyInteractiveLogonRight (test user is absent)
  • Srv_SeDenyRemoteInteractiveLogonRight (test user is absent)
  • Srv_SeInteractiveLogonRight (test user present)

I've been fighting with this problem for days now; it's now become a major headache. I'd be very grateful for any insights that might help find a resolution.

Thanks for looking.

1
Local account or AD? You can check the properties of the user, Remote Desktop Services Profile -> Deny this user permissions to log on to Remote Desktop Session Host server (unchecked). Also check local security policy (secpol.msc) Local Policies -> User Rights Assignment-> Deny log on through Remote Desktop Services, or Log on as a batch job./HAL9256

1 Answers

0
votes

The problem was that the account had been added to the AD domain 'DenyInteractiveLogon' group. Adding the account to the local 'Remote Desktop User' and/or the 'Srv_SeInteractiveLogonRight' groups had no effect.

Removing the user account from the domain group resolved the problem.