Adding Credentials to diffrent account from local system account

Question

Were using octopus for deployment, the tentacle is running as "local system account" I would like the tentacle to add credentials for a diffrent account. However I have no luck i doing so.

So far i tried creating a c# program which starts a new process as the other user, and the calls the cmdkey.exe

    private static void CallCmdKey(string runAsDomain, string runsAsUser, string runAsPass, string target, string user, string pass)
    {

        System.Diagnostics.Process proc = new System.Diagnostics.Process();

        proc.StartInfo.Arguments = $"/generic:{target} /user:{user} /pass:{pass}";
        proc.StartInfo.FileName = Environment.GetEnvironmentVariable("WINDIR") + "\\system32\\cmdkey.exe";
        Console.Out.WriteLine(proc.StartInfo.Arguments);
        proc.StartInfo.Domain = runAsDomain;
        proc.StartInfo.UserName = runsAsUser;
        proc.StartInfo.LoadUserProfile = true;


        SecureString sec = new SecureString();
        runAsPass.ToCharArray().ToList().ForEach(sec.AppendChar);
        proc.StartInfo.Password = sec;
        proc.StartInfo.WorkingDirectory = ".";

        proc.StartInfo.UseShellExecute = false;

        proc.Start();
        proc.WaitForExit();
        Console.Out.WriteLine("done");
    }

But it fails with access denied.

Then i tried power shell and psexec like this:

$psexec = "C:\temp\psexec.exe"
Invoke-Command -ScriptBlock{&$psexec -accepteula -u $WEB02AP2User -p $GISWEB02AP2Pass cmd /c cmdkey /generic:ffff /user:mufasa /pass:yoyo}

but it fails with

Access is denied. PsExec could not start cmd: The remote script failed with exit code 5

For security reasons Im not allowed to change account for the tentacle service

How can i sovle this issue

Answer 1

I Was unable to find a solutions to this issue. Only workaround was to let the octopusservice run as a specific user account