TFS 2015 Release Management Service: Setting up Deploying to an Untrusted Domain

To set up an Agent (build/release agent), in an untrusted domain, follow the below steps.

Navigate to TFS control panel using http://yourtfs:8080/tfs/_admin/_AgentPool and create a new agent pool. Then download the agent.zip file and keep it to copy over to the target agent machine.https://lh3.googleusercontent.com/-jR_gtODvVDI/V1g2G6jAj_I/AAAAAAAAHSM/KkeMVBKkHQk/image_thumb%25255B7%25255D.png?imgmax=800
Select the agent pool and click on Roles. Add the local user (rmshadowagent) created in TFS App Tier to the “Agent Pool Administrators” role, by clicking Add and then “Add Windows user or group”.https://lh3.googleusercontent.com/-6Gd_xcCMuak/V1g2I5JRleI/AAAAAAAAHSc/D9nhp9DDoYs/image_thumb%25255B19%25255D.png?imgmax=800

Add the same user to “Agent Pool Services Accounts” role for the selected pool.https://lh3.googleusercontent.com/-xym_3r5ZzHI/V1g2MPE5CCI/AAAAAAAAHS0/5uy2H_wYwX0/image_thumb%25255B30%25255D.png?imgmax=800
Copy over the agent.zip downloaded to the untrusted domain machine (agent machine). This machine should have access to yourTFSs URL. This can be achieved by exposing your TFS via www. Then a machine with an internet connection having access to the TFS URL can be an agent. Create folder for your agent. Example – C:\DeployAgent\Web, and extract agent.zip to it.https://lh3.googleusercontent.com/-FJ540tAysGw/V1g2OzYtkrI/AAAAAAAAHTE/B1CME8J4b4s/image_thumb%25255B33%25255D.png?imgmax=800

In the agent machine create a user with the same user name say “rmshadowagent” and with the same password you created in the TFS App Tier. (Add this user to Administrators group in agent machine to allow it to perform any activity in the machine as a deployment agent).https://lh3.googleusercontent.com/-RvZv6etrmew/V1g2aqGSzMI/AAAAAAAAHU4/r6J3nqriCK0/image_thumb%25255B58%25255D.png?imgmax=800

Run a command prompt as administrator in the agent machine and change the directory to extracted agent folder. Then execute ConfigureAgent.cmd and provide the parameters to configure.

Once you click OK it gives below error. But the agent is configured and available to use in the pool.

TF14045: The identity with type 'System.Security.Principal.WindowsIdentity' and

identifier 'S-1-5-21-1292816864-2021176197-253083057-1013' could not be found.

Additional resources