Bug: Administrators group lookup fails on non-English Windows → ACL setup breaks, service crashes #855
Description
On non-English Windows systems (e.g. German), Icinga for Windows fails during ACL setup because built-in security principals are resolved by hard-coded English names.
This affects both:
- the built-in Administrators group
- the service account NT AUTHORITY\NetworkService
On German Windows these are localized (e.g. Administratoren, NT-AUTORITÄT\NETZWERKDIENST) and therefore cannot be resolved by name.
As a result, ACL configuration fails and the Icinga PowerShell Framework cache is not writable, causing the PowerShell service to crash at runtime.
The framework repeatedly errors with:
[Error]: The local Administrators group does not exist or is invalid
As a result:
- ACLs are not applied correctly
- The PowerShell framework cache is not writable
- The Icinga PowerShell Service crashes at runtime
- Follow-up errors occur (e.g. failure to create cache\dll)
This appears to be caused by hard-coded usage of the English group name Administrators instead of resolving the group via SID.
Environment
- OS: Windows (German locale)
- Icinga for Windows Framework: 1.13.5
- Icinga PowerShell Plugins: 1.13.1
- Icinga Agent: 2.15.2
- Service account: NT AUTHORITY\NetworkService
- PowerShell: Windows PowerShell 5.1 (x64)
Installation Log (excerpt)
[Notice]: Installing component "agent" with version "2.15.2"
[Error]: The local Administrators group does not exist or is invalid
[Error]: The local Administrators group does not exist or is invalid
[Error]: The local Administrators group does not exist or is invalid
Runtime Errors
New-Item : Access to the path "dll" is denied
Path:
C:\Program Files\WindowsPowerShell\Modules\icinga-powershell-framework\cache\dll
and later:
The Icinga for Windows PowerShell instance assigned to this service is no longer present.
It either crashed or was terminated by the user. Stopping service.
Root Cause
- The framework tries to resolve:
- Administrators
- NT AUTHORITY\NetworkService
- These names do not exist on non-English Windows installations
- ACLs are therefore not applied
- Required cache paths are not writable by the service user
Workaround
Manually granting permissions via well-known SIDs works reliably:
# NetworkService
icacls "<framework cache path>" /grant "*S-1-5-20:(OI)(CI)M" /T
# Administrators
icacls "<framework cache path>" /grant "*S-1-5-32-544:(OI)(CI)F" /T
Suggested Fix
- Resolve built-in principals via well-known SIDs:
- S-1-5-32-544 → Administrators
- S-1-5-20 → NetworkService
- Avoid hard-coded English principal names
- Ensure ACL setup is fully locale-independent