Issue

When we try to run jobs that require interacting with the desktop or with the screen in a Windows agent which is installed as a service, the job fails. But if we run the command that the job is trying to run, from a command prompt opened in the windows agent, the command is completed without further issues.

When this happens, one of the most common causes is that the agent process is running inside what it is known as Session 0 Isolation, which was introduced back in 2007 in Windows Vista to avoid shatter attacks and it is still in use as of 2019.

This security feature causes the Jenkins agent to be running inside a less privileged session than most of the testing frameworks require to be able to run different test cases such as changing the screen resolution, open a browser, etc.

Environment

• CloudBees Core
• CloudBees Core on modern cloud platforms - Managed Master
• CloudBees Core on modern cloud platforms - Operations Center
• CloudBees Core on traditional platforms - Client Master
• CloudBees Core on traditional platforms - Operations Center
• CloudBees Jenkins Enterprise
• CloudBees Jenkins Enterprise - Managed Master
• CloudBees Jenkins Enterprise - Operations Center
• CloudBees Jenkins Platform - Client Master
• CloudBees Jenkins Platform - Operations Center
• CloudBees Jenkins Distribution
• Jenkins LTS

Resolution

In this particular case, one of the potential approaches to resolve the issue is bringing the agent process out of that secure session. In order to do that, we will need to launch the agent from an interactive session, once we do that, we will be running out of the limits of Session 0 thus, the job will be able to run without additional problems.

Using Java Web Start

• Select Java Web Start as launch method
  
• Grab the Launch command and download the agent.jar to the directory where you are going to run the command from.
  
• Open a Command Prompt window, if possible running it as Admin.

• Launch the agent using the command from the location where you downloaded the agent.jar file.
  

The only caveat for this procedure is that the agent will not be restarted if it fails or it is terminated, there are different ways to approach the solution of this problem but this is out of the scope of this Kb-Article.

Tested product/plugin versions

• CloudBees Core on traditional platforms - Client Master 2.164.2.1-rolling
• Windows Server 2012 R2 (64-Bits)

References

• Interactive Services Detection service removed in Windows 10