Start-Process : This command cannot be run due to the error: Access is denied

Question

I am trying to start NodeJS package from Azure DevOps with a inline powershell script.

Here is the script I've setup on Azure DevOps :

$backendFolder = "C:\path\to\backend"
$nodejsExecutable = "C:\Program Files\nodejs"

Set-location $backendFolder
Start-Process -FilePath $nodejsExecutable -ArgumentList "run","build" -wait -NoNewWindow -ErrorAction Stop -Verbose -WorkingDirectory $backendFolder
Start-Process -FilePath $nodejsExecutable -ArgumentList "run","start" -wait -NoNewWindow -ErrorAction Stop -Verbose -WorkingDirectory $backendFolder

Below is the output of the error :

2023-01-14T18:32:10.5104498Z Start-Process : This command cannot be run due to the error: Access is denied.
2023-01-14T18:32:10.5105828Z At C:\azagent\A3\_work\_temp\861703e2-7a4b-4544-b9d4-5722c8768a5a.ps1:8 char:1
2023-01-14T18:32:10.5106472Z + Start-Process -FilePath $nodejsExecutable -ArgumentList "run","build" ...
2023-01-14T18:32:10.5106954Z + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2023-01-14T18:32:10.5107500Z     + CategoryInfo          : InvalidOperation: (:) [Start-Process], InvalidOperationException
2023-01-14T18:32:10.5108092Z     + FullyQualifiedErrorId : InvalidOperationException,Microsoft.PowerShell.Commands.StartProcessCommand

I've tried numerous things, from adding the $path in environment variables, allowing full permissions to both folders in "C:\Program Files\nodejs" & "C:\path\to\backend" but same results.

Note # It's running on Windows and a IIS web server! On Azure DevOps I've created this steps - Stop IIS, Stop Node, Create IIS web app, Deploy IIS web app, Start Node & run the 2 powershell scripts to build & start the NodeJS app.

Any idea what's going on here or what I'm I missing?

Answer 1

Issue was caused due to the credential are trying to use. Start-Process starts the program as similar to the Invoke-Item.

use the parameters of Start-Process to specify options, such as loading a user profile, starting the process using alternate credentials.

Example like

$cred = Get-Credential
$args = *********************
Start-Process ****** -Credential $cred -WindowStyle Hidden -ArgumentList $args

refer this syntax's from official site.

Here the tutorial of Configure CI/CD for Node application with Azure Pipelines for more information.

Answer 2

Update:

So I've done 2 things to fix this issue, maybe 3 things.

1. I've removed the complete agent setup and ran it as the actual user on the VM, previously I've set it up with the System user (NT AUTHORITY\SYSTEM).

NT AUTHORITY\SYSTEM

2. I followed this link to add the user to impersonate the account. Remember to run gpupdate /force & restart the Azure Agent service under Services.

Local Security Policy -> Local Policies -> User Rights Assignment -> "Impersonate a client after authentication"

3. I've changed the $nodejsExecutable = "C:\Program Files\nodejs" to $nodejsExecutable = "C:\Program Files\nodejs\npm.cmd" but it might be different in other cases.

Thanks.