Skip to content

Windows agents running under a named service account

  • Introduced in: OpenAEV 3.261016.0

Description of changes

The installer now limits access to the agent's config file, openaev-agent-config.toml, which contains its token, to SYSTEM, Administrators and the agent's account.

Impact

This change requires action on hosts using service-user mode (a Windows service running under a named account). Upgrading only replaces the binary, it does not fix existing file permissions.

LocalSystem and user-session installs get the fix automatically on upgrade.

Migration guide

After upgrading:

  1. Reinstall the agent from the platform.

  2. Check the permissions of the config file:

    icacls "<install folder>\openaev-agent-config.toml"

    Only SYSTEM, Administrators and the service account should appear, with no (I) (inherited permissions).

Warning

If other users could read the config before, treat the token as exposed. Fixing permissions does not invalidate a copied token.