How to give extra privileges to the runner over the self-hosted Windows server?

[JacobWrenn]

It looks like the runner uses the nt authority\network service account to run PowerShell commands (checked using whoami within the workflow).

This isn't useful when trying to deploy my app to my server. For example, I need to use schtasks.exe which gives ERROR: Access is denied.

Can I give extra privileges to the runner to avoid issues like this?

[JacobWrenn]

For some extra background: I am trying to recreate a release pipeline that I had in Azure DevOps. Because the self-hosted agents over there ran commands with the nt authority\system account I never ran into any permissions issues.

[JacobWrenn]

I found the easiest solution for my issue was to change the account the GitHub Actions service ran under.

I achieved this by using powershell "(Get-Service actions.runner.*).name" to find the name of the GitHub Actions service.

And then running sc config "NAME_OF_YOUR_SERVICE" obj= "NT AUTHORITY\SYSTEM" type= own to update it to run as the system.

[snankens]

hi Jacob Wrenn,
I'm trying your solution but got some trouble,
after I run the first command I got the runner name,
but the second return me the the following error:
Set-Content : A positional parameter cannot be found that accepts argument 'obj='.
can you help me please?

[Papooch]

@snankens you need to run the command with cmd and not powershell.

[gbakeman]

Is there any chance this applies to GitHub-hosted runners as well? For one reason or another, the privileges the runner runs under are not sufficient for me to install a tool that I need to compile. It looks like there are no services under actions.runner.*, in fact nothing that appears to be related to GitHub at all. I'm not sure how it's running my script on the runner.

[thiago-scherrer]

I found the easiest solution for my issue was to change the account the GitHub Actions service ran under.

I achieved this by using powershell "(Get-Service actions.runner.*).name" to find the name of the GitHub Actions service.

And then running sc config "NAME_OF_YOUR_SERVICE" obj= "NT AUTHORITY\SYSTEM" type= own to update it to run as the system.

worked perfectly @JacobWrenn !
I needed to restart the service after adding the permission

[damian-tomczak]

Is there any chance this applies to GitHub-hosted runners as well? For one reason or another, the privileges the runner runs under are not sufficient for me to install a tool that I need to compile. It looks like there are no services under actions.runner.*, in fact nothing that appears to be related to GitHub at all. I'm not sure how it's running my script on the runner.

Hey,

Have you found a way to do it? I mean on Github-hosted runners.

BR

[gbakeman]

Is there any chance this applies to GitHub-hosted runners as well? For one reason or another, the privileges the runner runs under are not sufficient for me to install a tool that I need to compile. It looks like there are no services under actions.runner.*, in fact nothing that appears to be related to GitHub at all. I'm not sure how it's running my script on the runner.

Hey,

Have you found a way to do it? I mean on Github-hosted runners.

BR

Hi BR,

My problem ended up being that the tool I was using did not output information that it was running, it was actually just taking a long time and permissions were not an issue. GitHub gives the runner process quite a lot of privileges on Windows; UAC is disabled so you have lots of latitude to do what you need.