Validate that unprivileged installation works with Windows Active Directory

[blakerouse]

Overview

Validation needs to be performed to ensure that the unprivileged mode installation works with a Windows machine that is enrolled into Active Directory.

Test 1

The first test just needs to use the standard --unprivileged flag when installing and keep the defaults. That should create the standard local users for the Elastic Agent to run unprivileged.

Validate the following:

• Service is installed with the correct run as users
• User is created
• Group is created
• Runs correctly

Test 2

The second test needs to use the --user, --password, and --group to install unprivileged where the --user and --group should be Active Directory users and groups.

Validate the following:

• Service is installed with run as --user
• User is not created (existing user used for --user)
• Group is not created (existing group used for --group)
• Runs correctly

[amolnater-qasource]

Hi @blakerouse @pierrehilbert

We have tested elastic-agent installation using --unprivileged on Windows Server 2022 with Active Directory setup and had below observations:

Scenario 1:

• We have installed Elastic Agent using --unprivileged flag with Active Directory setup.
  • Elastic Agent gets installed successfully.
  • User and Group is created.
  • Elastic Agent service runs with correct user.
  • No issue on Installed agent is observed.

Screenshots:

Scenario 2:

• Uninstalled previous agent and then installed Elastic Agent using --unprivileged, --user, --password, --group flag with Active Directory setup. [Created User and Group manually in Active Directory.]
  • Elastic Agent gets installed successfully.
  • Elastic Agent service runs with correct user.
  • No issue on Installed agent is observed.

Screenshots:

Build details:
VERSION: 9.3.0-SNAPSHOT
BUILD: 93303
COMMIT: 07655a0a20808401ae4531541ed85885b2f61fea
Artifact Link: https://snapshots.elastic.co/9.3.0-fe116a51/downloads/beats/elastic-agent/elastic-agent-9.3.0-SNAPSHOT-windows-x86_64.zip

Hence, we are marking this issue as QA:Validated.

Please let us know if we are missing anything here.

Thanks!!

[pierrehilbert]

That's a great news, thanks @amolnater-qasource for the testing.
Should we document somewhere how you deploy the AD in case we need to have one for future testing?

cc @nimarezainia / @ebeahan

[cmacknz]

The original plan we had was to only GA this once we had automated testing in place for this.

I don't want us to GA something we can't easily reproduce problems on and that needs to be manually tested in every single release we do (because we can accidentally break it without automation).

[nimarezainia]

Test is just going to run through the steps that Amol has mentioned in his test correct?

We can certainly put this on our list of ktlo items and get to it. However we have a customer deployment concern who asked for this to be GA. Can we move forward on that while we triage the testing part?

[pierrehilbert]

We can certainly put this on our list of ktlo items and get to it. However we have a customer deployment concern who asked for this to be GA. Can we move forward on that while we triage the testing part?

According to me, answering this question requires @ebeahan's inputs about the timing we may expect before having someone working on this.

[amolnater-qasource]

Hi Team,

We have shared the documentation for Active Directory Setup and Agent Installation over slack.

Please let us know if anything else is required from our end.

Thanks!!

[blakerouse]

@amolnater-qasource When you say you tested this with Active Directory setup, does that mean that the test was done on a Windows host that was also the domain controller, or was it done on a host that was enrolled into a domain (but was not the controller)?

[nimarezainia]

We can certainly put this on our list of ktlo items and get to it. However we have a customer deployment concern who asked for this to be GA. Can we move forward on that while we triage the testing part?

According to me, answering this question requires @ebeahan's inputs about the timing we may expect before having someone working on this.

@pierrehilbert I am asking whether we can fix the docs now based on this testing which shows it working satisfactorily. Decoupling the response to the customer (who is blocked) from doing the right thing and having regular testing. Similar to what we do with OS validation.

[amolnater-qasource]

When you say you tested this with Active Directory setup, does that mean that the test was done on a Windows host that was also the domain controller, or was it done on a host that was enrolled into a domain (but was not the controller)?

@blakerouse testing was done on Windows Server 2022 image having the Domain Controller. Could you please confirm if we are missing anything here?

Thanks!