Elastic Agent changes local security policy?

ben-sec · April 29, 2025, 7:47am

Hi!

I wanted to point an existing Windows Elastic Agent to a new Elasticsearch instance and used the following commands:

.\elastic-agent unprivileged -f --user="user name" --password="PW"
.\elastic-agent.exe enroll -f -i --url=https://url --enrollment-token=ABC==
.\elastic-agent privileged -f

This worked fine, BUT: The local Windows security policy has been changed and the user above was no longer able to login locally, via network nor via RDP. This happend on two test machines and I'm glad that we have not rolled this out to all users. What happend there?

Cheers, Ben

NickFritts · April 29, 2025, 8:42am

When you call the elastic-agent unprivileged command to swap an agent from running in a privileged (admin) mode, to a restricted mode, agent ensures the provided user and password is restricted to only be able to operate as a service with limited permissions. The user provided should not be an account anyone else would log in to as it will be a restricted, local service only account after the command is run.

github.com/elastic/elastic-agent

internal/pkg/agent/install/user_windows.go

main


      
          		uintptr(unsafe.Pointer(&info)),
          		uintptr(unsafe.Pointer(&parmErr)),
          	)
          	if ret != 0 {
          		return "", fmt.Errorf("call to NetUserAdd failed: status=%d error=%d", ret, parmErr)
          	}
          
          	return FindUID(name)
          }
          
          func EnsureRights(name string) error {
          	// adjust the local security policy to ensure that the created user is scoped to a service only
          	sid, _, _, err := gowin32.GetLocalAccountByName(name)
          	if err != nil {
          		return fmt.Errorf("failed to get SID for %s: %w", name, err)
          	}
          	sp, err := gowin32.OpenLocalSecurityPolicy()
          	if err != nil {
          		return fmt.Errorf("failed to open local security policy: %w", err)
          	}
          	defer sp.Close()

ben-sec · April 29, 2025, 9:25am

Thanks, good to know!

Topic		Replies	Views
Elastic Agent Updating forever Endpoint Security fleet	2	509	January 22, 2023
Endpoint Security 8.4.1 Security Update Security Announcements	0	9895	January 23, 2023
Elastic-agent add - error protocol integration http/https Elastic Agent elastic-stack-security	5	338	December 8, 2022
Elastic Agent (Security Onion) Elastic Agent elastic-stack-monitoring	11	662	November 23, 2024
Elasticsearch security rule and alert testing Elastic Security	3	63	February 24, 2025

Elastic Agent changes local security policy?

Related topics