How do you fix "Access is denied" when trying to create a service while registering an agent in a deployment pool?

Question

When I go to "Azure DevOps > Organization Settings > Deployment Pools > {DeploymentPoolName}", it gives me a PowerShell script to establish a target to register on my VM. It basically looks like this:

$ErrorActionPreference="Stop";If(-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent() ).IsInRole( [Security.Principal.WindowsBuiltInRole] "Administrator")){ throw "Run command in an administrator PowerShell prompt"};If($PSVersionTable.PSVersion -lt (New-Object System.Version("3.0"))){ throw "The minimum version of Windows PowerShell that is required by the script (3.0) does not match the currently running version of Windows PowerShell." };If(-NOT (Test-Path $env:SystemDrive\'azagent')){mkdir $env:SystemDrive\'azagent'}; cd $env:SystemDrive\'azagent'; for($i=1; $i -lt 100; $i++){$destFolder="A"+$i.ToString();if(-NOT (Test-Path ($destFolder))){mkdir $destFolder;cd $destFolder;break;}}; $agentZip="$PWD\agent.zip";$DefaultProxy=[System.Net.WebRequest]::DefaultWebProxy;$securityProtocol=@();$securityProtocol+=[Net.ServicePointManager]::SecurityProtocol;$securityProtocol+=[Net.SecurityProtocolType]::Tls12;[Net.ServicePointManager]::SecurityProtocol=$securityProtocol;$WebClient=New-Object Net.WebClient; $Uri='https://vstsagentpackage.azureedge.net/agent/4.251.0/vsts-agent-win-x64-4.251.0.zip';if($DefaultProxy -and (-not $DefaultProxy.IsBypassed($Uri))){$WebClient.Proxy= New-Object Net.WebProxy($DefaultProxy.GetProxy($Uri).OriginalString, $True);}; $WebClient.DownloadFile($Uri, $agentZip);Add-Type -AssemblyName System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory( $agentZip, "$PWD");.\config.cmd --deploymentpool --deploymentpoolname "MyDeploymentPoolName" --agent $env:COMPUTERNAME --runasservice --work '_work' --url 'https://ABC.visualstudio.com/'; Remove-Item $agentZip;

However, while it does install parts of the agent, there is an executable "C:\azagent\A1\bin\AgentService.exe" that throws the error "Access is denied", both during creation and when trying to run it, regardless of whether the user is an Administrator, the script is run in Administrator mode, or the access permissions to the file are altered. I've tried this with many different accounts, but it is always the same result. Due to this, I cannot start my agent as a service, and I have to manually run the agent with the "run" command, which of course stops running with I log out of the machine. Do you think you can help me investigate why this is happening, and help me fix it?

Answer 1

I am facing the same issue, anyone can shed a light on this?

System.ComponentModel.Win32Exception (5): An error occurred trying to start process '"C:\azagent\A4\bin\AgentService.exe"' with working directory 'C:\azagent\A4'. Access is denied.

Microsoft.VisualStudio.Services.Agent.Listener.Configuration.ConfigurationManager.ConfigureAsync(CommandSettings command) in D:\a_work\1\s\src\Agent.Listener\Configuration\ConfigurationManager.cs:line 442

at Microsoft.VisualStudio.Services.Agent.Listener.Agent.ExecuteCommand(CommandSettings command) in D:\a_work\1\s\src\Agent.Listener\Agent.cs:line 103

[2025-03-11 16:25:16Z ERR Terminal] WRITE ERROR: An error occurred trying to start process '"C:\azagent\A4\bin\AgentService.exe"' with working directory 'C:\azagent\A4'. Access is denied.