I have already created the TFS Build Agent pool windows service that is running periodically and tries to connect to TFS,
It seems it tries to run with its own credentials and the windows service is installed on a Server that is not in the same domain as TFS (but I can access the TFS from this sever), so It fails with the below error
Error in the service log file:
Microsoft.VisualStudio.Services.Common.VssUnauthorizedException:
VS30063: You are not authorized to access https://tfsURL.
How to impersonate or making the agent Pool Windows service connected as "NT AUTHORITY\Network" or with another credentials from server in a domain to the TFS which in another domain
You can either re-configure the build agent to enter a name of the user account to use for the service like the screenshot below:
Or open the Services, right click the agent service, and then select Log On tab to change the account that runs the agent:
Related
I just created a new Build server and added it to an existing Queue, I turned off the other agents in the queue so that this new build server would get the job. I sent a very simple .NET build but the build window says "Waiting for an available agent"
So I get it, I must have missed installing something on the build server. So when the job is submitted it's looking for an agent that can satisfy the "capabilities" How can I see that what capabilities the job needs so I can see why it's stuck?
As far as I know, if the agent capabilities couldn't meet the build demands, it will show the warning message at the build result or queue time.
For example:
You could try the following points to troubleshooting:
Navigate to Local machine->Service and check if the Visual Studio Team Foundation Background Job Agent is running on the TFS application tier server.
You could start or restart this service.
Make sure the account that the agent is run under is in the Agent Pool Service Account role or Project Collection Build Service Accounts and the account is a domain account.
TFS2015 -> Agent Pool Service Account
TFS2017 TFS2018 ->Project Collection Build Service Accounts
Change another available account for agent service, restart the service.
3.Restart the whole TFS server and check if this do the trick. Need some time to wait.
Here is another ticket with the similar issue, you could refer to it.
Hope this helps.
Recently I was able to configure a build agent on my laptop and queue a successful build on TFS.
Then I tried to switch to a build server VM. I created a service account with the same rights as my account I was using from the laptop and configured a new build agent on the machine to use the service account and the same pool and started the agent.
When I log into TFS I can see the agent running in the correct pool, and it is green. So I disabled the agent from the laptop, so it would use the new agent on the build server. However, when I queue a build to the pool, the message displays "all possible agents have been disabled". So my new agent is in the pool and enabled, but when I queue a build it is not seen as a possible agent.
How do I make the new agent pick up the request to queue a new build? I verified it's running as a service on the build machine.
Please make sure the service account is a domain account and is part of “Agent Pool Service Accounts” group in TFS under your Agent Pool.
Then check the capabilities, and make sure the agent capabilities match the one set in the build definition. In addition, private agents give you more control to install dependent software needed for your builds and deployments. You can compare with you laptop, to check if there are any necessary dependent software misinstalled.
I am using Visual Studio Team Services (was Visual Studio Online), and I have a build agent installed onto a machine inside a VPN.
Is it possible to configure my build in Team Services and have it run using the agent inside my private VPN? If so, how do you connect to the VPN when running a build?
Yes the agent can run anywhere as long as it can access the VSTS instance (it has a public internet connection).
The basic steps are:
Install the agent on a machine/VM within you network
Run ConfigureAgent.cmd
Set the TFS URL to your VSTS url (https://[account].visualstudio.com)
Provide your creds in the authorization window popup
You're connected!
https://msdn.microsoft.com/en-us/library/vs/alm/build/agents/windows
I'm trying to set-up a new build server for my TFS 2013 installation.
On a new machine, I've configured a build user:
On test, this approved the user fine; however, running the readiness checks reports:
My interpretation of this error is that build.user does not have access to TFS; which is correct. My question is: can I run the build server using a domain user, but with a separate user for TFS access?
Can I run the build server using a domain user, but with a separate user for TFS access? Yes, you can and the build service account do not need to have the access to TFS.
Suggest you use TFSBuild as the build service account as MSDN recommend.
TFSBuild, which can be a local account, a domain account, or Local
Service in a workgroup
This service account is used when builds are configured and when build
status information is communicated between the build controller and
the build agents. More info for you
reference:https://msdn.microsoft.com/en-us/library/ms253149(v=vs.120).aspx
We have a TFS build agent that runs integration tests. Some of these tests make calls to web services on the Internet.
Our network uses a proxy to talk to the Internet.
Since the build agent runs under the identity on Network Service and the settings of Network Service are not configured to use the proxy, the tests fail.
How do I do one of the following?
Change the identity of the build agent to a domain account
Configure Network Service to use the proxy
To change the identity of the build agent you just go into Windows Services and change the identity of the TFSBuild service (service name is "Visual Studio Team Foundation Build").