Powershell working with alternate credentials from Octopus Deploy

Question

I have an Octopus Tentacle with a deployment script. The tentacles work as a LocalSystem account.

Inside the script, I can do almost everything I need, except for some archive bit. Archiving must be performed under different domain credentials, because it is located in a network share.

This upsets the fact that the code below works locally, but when it starts running the tentacles, it fails with an error

----------------------------------------------- --- - [Backup Nupkg] ----------------------------------------- - --------- Saving a backup version of GeoSphere.1.2.1.1722.nupkg for the development environment
Error 09:24:32 [localhost] Error starting background process. Error Error 09:24:32 reported: Access - denied. Error 09:24:32 C: \ Octopus \ deployments \ Development \ GeoSphere \ 1.2.1.1722 \ deploy.ps1: 121
Error 09:24:32 char: 1 Error 09:24:32
+ Receive-receive error $ 09: 43: 32
+ ~~~~~~~~~~~~~~~~~ Error 09:24:32
+ CategoryInfo: OpenError: (localhost: String) [], PSRemotingTran Error 09:24:32 sportException Error 09:24:32
+ FullyQualifiedErrorId: -2147467259, PSSessionStateBroken Info 09:24:32 HasMoreData: False StatusMessage: Location:
Localhost command: Import module $ args [3]
Backup-Nupkg $ args [0] $ args [1] $ args [2]
JobStateInfo: crash completed: System.Threading.ManualResetEvent InstanceId:
0c031592-4c2a-4f8b-b014-a5ba79be09f7 Id: 1 Name:
Job1 ChildJobs: {Job2} PSBeginTime: 11/13/2014 9:24:30 AM
PSEndTime: 11/13/2014 9:24:31 AM PSJobTypeName: BackgroundJob
Result: {} Error: {} Progress: {} Detailed
: {} Debugging: {} Warning: {} Status: failed
Fatal 09:24:32 PowerShell script returned non-zero exit code: 1
Tentacle Version 2.5.11.614

Here is the code

$pwd = convertto-securestring "[PASSWORD]" -asplaintext -force $cred=new-object -typename System.Management.Automation.PSCredential -argumentlist "[DOMAIN\USER]",$pwd $packageName = "GeoSphere.$Version.nupkg" $backupPath = $($es.backupPath) $artifactsPath = $($es.artifactsPath) $job = Start-Job -ScriptBlock { Import-Module $args[3] Backup-Nupkg $args[0] $args[1] $args[2] } -ArgumentList @($packageName,$backupPath,$artifactsPath,"$currentDir\modules\ApplicationUtilities") -Credential $cred Wait-Job $Job Receive-Job $job 

Here is ApplicationUtilities Module

 function Backup-Nupkg{ param( [parameter(Mandatory=$true,position=0)] [string] $packageName, [parameter(Mandatory=$true,position=1)] [string] $backupPath, [parameter(Mandatory=$true,position=2)] [string] $artifactsPath ) if(!(Test-Path $($backupPath))) { md $($backupPath) } else { Remove-Item "$($backupPath)\*" -recurse -Force } Copy-Item $artifactsPath\$packageName $backupPath } Export-ModuleMember Backup-Nupkg 

What is the magic trick to make it run away from the tentacle, how does it happen locally?

Answer 1

I tried the same thing without any luck, it seems that starting tasks by another user is impossible. In this similar question, Leblanc ended up using WinRM and Invoke-Command instead:

run the script as a specific user with Powershell

(I don’t think this is something special Octopus - the problem seems to be more related to the fact that SYSTEM can start processes as another user or with the help of Start-Job in the SYSTEM section or maybe both)