Python Extension 2.0 - Using LocalSystem user

[Benji_Dynatrace]

Hi,

this is pretty self explanatory, we are trying to build extensions that can do things with admin rights (like running certain powershell scripts for example) but we noticed that the python environment run on the LocalService account which doesn't have admin rights. So our question is this, is there a way to deploy the python environment so that it runs on LocalSystem instead of LocalService?

Thanks!

[Mike_L · Accepted solution]

There is not. The way we work around this is by asking for a username and password and running the commands as that user.

Please raise a product idea if that is insufficient for you.

[Benji_Dynatrace]

Hi Mike,

are there any examples on how to implement the execution using given usernames and passwords, we haven't been able to replicate it on our end.

Thanks

[Mike_L]

You can grab either the extended activedirectory extension or the Citrix extension from the hub. They have implemented that functionality.

[jonhaugen]

Hi Michael, 

Can you please elaborate on some of the thoughts behind this decision? Every other Oneagent process is running as NT AUTHORITY\SYSTEM including the old extension process.

There are a few extensions where you need to run as SYSTEM such as when querying a database or listing any IIS related properties. This is even visible in the new IIS Extension available through the Hub where App pools and sites is listed with metrics through WMI, but no relationships between each other.

Thank you very much in advance! 

EDIT:
Added Product Idea: https://community.dynatrace.com/t5/Product-ideas/Python-Extension-2-0-run-as-NT-AUTHORITY-SYSTEM/idi...

[Mike_L]

It was a requirement from our security department. As extension framework 2.0 distributes code, it was important that the code does not run as a privileged user. We were looking into a way to opt out of the more secure method, your product idea will help put that onto the radar again.