Unable to re-enrolled installed Elastic Agent on Windows

[blakerouse]

On Windows with an installed Elastic Agent that is enrolled into Fleet is unable to re-enroll. Performing enroll results in the following error:

C:\Program Files\Elastic\Agent>.\elastic-agent.exe enroll --url={url} --enrollment-token={token}
Error: the command is executed as root but the program files are not owned by the root user.
For help, please see our troubleshooting guide at https://www.elastic.co/guide/en/fleet/8.17/fleet-troubleshooting.html

For confirmed bugs, please report:

• Version: 8.17.3+
• Operating System: Windows
• Steps to Reproduce:

1. Install elastic-agent.exe on Windows (not in unprivileged mode).
2. Go into that directory and then run .\elastic-agent.exe enroll and see that it fails with the following error:

C:\Program Files\Elastic\Agent>.\elastic-agent.exe enroll --url={url} --enrollment-token={token}
Error: the command is executed as root but the program files are not owned by the root user.
For help, please see our troubleshooting guide at https://www.elastic.co/guide/en/fleet/8.17/fleet-troubleshooting.html

[elasticmachine]

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)

[ebeahan]

Possibly introduced by #6144?

[swiatekm]

Sounds like we should have a more sophisticated ownership check there. We should allow enrollment to proceed if the executing user is a normal user running the command in a privileged context.

[cmacknz]

We have another report of this internally on Slack.

[mbudge]

Our virtual desktops are built from an image, which as of Thursday is on 8.17.4. Where was the notification there was a critical bug in this release?

Epic outage on 2000-3000 endpoints.

Please improve release/testing processes so code changes are in the first minor release, and subsequent maintenance releases are for bug fixes.

With agent running on business critical endpoints we need to guarantee stability.

Thanks!

[cmacknz]

Thanks for the feedback, we'll get release notes updated and make sure there is a test for re-enrolling as part of the fix we do here. We are working to catch up test coverage but there are still gaps.

[mbudge]

Are we going to stop putting new code into .1+ agent/endpoint maintenance releases?

It's really important this stops as this part of the elastic stack can directly impact business operations.

:)