Windows Agent: "Verify the user running Nolio agent has privileges to impersonate other users" error

Products

• CA Release Automation - Release Operations Center (Nolio)
• CA Release Automation - DataManagement Server (Nolio)

Issue/Introduction

An action fails with one or both of the two following errors:

Unable to run action for user <username>. Verify the user running Nolio agent has privileges to impersonate other users, and that user has permissions on Nolio installation folder. 

and / or:

Error occurred during action execution: Cannot use <user> credentials: The handle is invalid. Make sure that the password typed correctly, and the user is in the username@domain format.

Note: This problem is specific to actions that are configured (in their properties/settings tab) to "Use the following credentials".

Environment

Release Automation Agent (all supported versions) on Windows

Cause

The user account that the Nolio Agent service is configured to run as does not have sufficient privileges.

Resolution

There are three possible ways to resolve this issue (for more recent versions of Windows Server, all three solutions may be necessary):

Solution 1 - Add the agent service's user to local administrators:

1. Open the properties of the Nolio Agent service.
2. Click the "Log On" tab.
3. Verify the user account used to start the service.
4. Add that user to the local Administrators group.
5. Stop and restart the agent.

Solution 2 - Grant Local Security Policy permissions to the domain user the action is impersonating:

1. In Windows, open the Control Panel.
2. Navigate to: System and Security -> Administrative Tools -> Local Security Policy. 
3. In Security Settings, go to: Local Policies -> User Rights Assignment.
4. Add the user account to the policy "Replace a process level token privilege".
5. Add the user account to the policy "Adjust memory quotas for a process".

Solution 3 - Verify agent folder permissions:

1. Navigate to the agent installation directory. If the agent was installed in the default location, this will be "C:/.../ReleaseAutomationServer/NolioAgent/". 
2. Right-click the "NolioAgent" folder and select "Properties".
3. Click the Security tab.
4. Ensure the user that the action is impersonating has both read and write permissions to this directory. 

Additional Information

Additional messages in the agent's nolio_all.log file that are symptoms of this issue may include, but are not limited to, the following:

• load profile result: A required privilege is not held by the client.
• load profile result: Access is denied.
• Cannot create process using the logonUser and createProcessAsUser.
• Cannot create process remote process
• The handle is invalid
• Cannot use <username> credentials
• load profile result: An attempt was made to reference a token that does not exist.