Issue

When we try to run jobs that require interacting with the desktop or with the screen in a Windows agent which is installed as a service, the job fails. But if we run the command that the job is trying to run, from a command prompt opened in the windows agent, the command is completed without further issues.

When this happens, one of the most common causes is that the agent process is running inside what it is known as Session 0 Isolation, which was introduced back in 2007 in Windows Vista to avoid shatter attacks and it is still in use as of 2019.

This security feature causes the Jenkins agent to be running inside a less privileged session than most of the testing frameworks require to be able to run different test cases such as changing the screen resolution, open a browser, etc.

Environment

• CloudBees CI (CloudBees Core)
• CloudBees CI (CloudBees Core) on modern cloud platforms - Managed controller
• CloudBees CI (CloudBees Core) on modern cloud platforms - Operations Center
• CloudBees CI (CloudBees Core) on traditional platforms - Client controller
• CloudBees CI (CloudBees Core) on traditional platforms - Operations Center
• CloudBees Jenkins Enterprise
• CloudBees Jenkins Enterprise - Managed controller
• CloudBees Jenkins Enterprise - Operations Center
• CloudBees Jenkins Platform - Client controller
• CloudBees Jenkins Platform - Operations Center
• CloudBees Jenkins Distribution
• Jenkins LTS

Resolution

In this particular case, one of the potential approaches to resolve the issue is bringing the agent process out of that secure session. In order to do that, we will need to launch the agent from an interactive session, once we do that, we will be running out of the limits of Session 0 thus, the job will be able to run without additional problems.

Using Java Web Start

In newer versions of Jenkins (since 2.176.1) this launch method is no longer known as “Launch agent via Java Web Start”. Instead, you will find it as “Launch agent by connecting it to the controller” (formerly ‘master’).

• Select ”Java Web Start” or “connecting it to the controller” as launch method (It will depend on the Jenkins version).
  

• Grab the Launch command and download the agent.jar to the directory where you are going to run the command from.
  

• Open a Command Prompt window, if possible running it as Admin.

• Launch the agent using the command from the location where you downloaded the agent.jar file.
  

The only caveat for this procedure is that the agent will not be restarted if it fails or it is terminated, there are different ways to approach the solution of this problem but this is out of the scope of this Kb-Article.

Tested product/plugin versions

• CloudBees CI (CloudBees Core) on traditional platforms - Client controller 2.164.2.1-rolling
• Windows Server 2012 R2 (64-Bits)

References

• Interactive Services Detection service removed in Windows 10