Error while trying to setup Icinga Agent on German Windows Server 2025

[IM-markus1909]

We have trouble setting up the Icinga Agent on a german Windows Server 2025 system. It only works if we run the our install script for a second time.

This is our install script:

`Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process

Invoke-WebRequest -UseBasicParsing -Uri 'http://<servername>/IcingaForWindows/IcingaForWindows.ps1' -OutFile C:\Temp\IcingaForWindows.ps1;
C:\Temp\IcingaForWindows.ps1 -IcingaRepository 'http://<servername>/IcingaForWindows/stable/ifw.repo.json' -ModuleDirectory 'C:\Program Files\WindowsPowerShell\Modules\' -SkipWizard;
Use-icinga;

Install-Icinga -InstallCommand '{"IfW-ParentAddress":{"Values":{"<servername>":["<IP>"],"<servername>t":["<IP>"]}},"IfW-Hostname":{"Selection":"1"},"IfW-Certificate":{"Selection":"0"},"IfW-ParentZone":{"Values":["satellite01"]},"IfW-StableRepository":{"Values":["http://<servername>/IcingaForWindows/stable/ifw.repo.json"]},"IfW-Connection":{"Selection":"0"},"IfW-ParentNodes":{"Values":["<servername>","<servername>"]}}' -Force;

`

This is the error log on our german system:

scesrv_german.log

Konfigurieren von EINGESCHRÄNKTE DIENSTE\ALLE EINGESCHRÄNKTEN DIENSTE. Fehler 1332: Zuordnungen von Kontennamen und Sicherheitskennungen wurden nicht durchgeführt. EINGESCHRÄNKTE DIENSTE\ALLE EINGESCHRÄNKTEN DIENSTE wurde nicht gefunden. Konfigurieren von S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420. Fehler 18: Es sind keine weiteren Dateien vorhanden.

However we tested the same install script on an english system and got no errors:

scesrv_english.log

Note that if we run the same script a second time on the german system it works just fine.

[LordHepipud]

I did some digging in this case and found the reason for this behavior.

On the left side of the screenshot is a german system and on the right side the englisch one.

We use secedit to modify the policy of SeServiceLogonRight, allowing created users like icinga for JEA to receive the permission to run as service.

However, secedit does seem have an issue on non-german system, unable to properly translate the given name to the SID of the system.

This is the reason, why it fails on the first attempt and completes successfully on the second run, as on the second run the EINGESCHRÄNKTE DIENSTE\ALLE EINGESCHRÄNKTEN DIENSTE ist simply removed.

Based on my current research, it shouldn't affect the Windows system at all, but still this is an issue we need to fix.

There are now two options: We either update our handling with secedit to be more reliable even on non-englisch systems or use a different approach like the LSA-API (Local Security Authority). We just need to make sure the API is backward and forward compatible accross all Windows versions we want to support.

Another issue is the following on a German system:

We can fetch the SID for the missing user only by the englisch name. The german one is simply not supported and returning nothing. As we use the same functionallity as Windows, we can replicate this behavior with our own methods.

A short them solution could be to always manually add the SID's S-1-5-80-0 and S-1-5-99-0, as these are the default values on fresh Windows installations and just extend it with our own user SID for the Icinga Agent and Icinga for Windows service.

During an update of Icinga for Windows, we could force the policy update, ensuring systems which are missing this SID from the configuration are "repaired".

But like I said, based on my research this shouldn't affect anything on Windows at all.