Tfs2015 Build agent error: Access denied: xxxxx\yyyyy needs Listen permissions for pool zzzzz to perform the action

Tfs 2015 introduces a completely new and redesigned build system and one of the most important change is new lightweight agent system. Instead of installing TFS and then configure Build, to create a new agent you only need to download a zip file, uncompress and launch a PowerShell script. Another great advantage is the ability to run the agent as a service, or running it interactively in a simple console application.

If you configure a new agent you can check that everything is ok in TFS Control panel, in the new Agent pools tab. The new agent should be listed and it is Red if not active, Green if up and running.

image

Figure 1: Management of Pool and Agent in TFS Configuration

If the agent is red even if you launched the agent, you should check logs in the _diag folder.

image

Figure 2: Logs are placed in _diag folder

You should be able to understand and fix errors looking at the log. If you run the agent interactively, it could be that your user has no right permission to listen to the pool.

17:28:46.531831 Microsoft.TeamFoundation.DistributedTask.WebApi.AccessDeniedException: Access denied. CYBERPUNK\Administrator needs Listen permissions for pool Fast to perform the action. For more information, contact the Team Foundation Server administrator.

In this situation the user Administrator is in the TFS Administrator Group and it should have any permission, but new Build System is slightly different. The user that runs the agent, must be part of the Agent Pool Service Account, or it will not be able to run the agent

image

Figure 3: Permissions for Agent Pools

Simply adding the user to the AgentPoolService account should fix authorization problem

image

Figure 4: Agent is up and running.

Gian Maria

Published by

Ricci Gian Maria

.Net programmer, User group and community enthusiast, programmer – aspiring architect – and guitar player :). Visual Studio ALM MVP

2 thoughts on “Tfs2015 Build agent error: Access denied: xxxxx\yyyyy needs Listen permissions for pool zzzzz to perform the action”

  1. I had the same issue yesterday till I figured it out.
    the agent show now a green icon but when I’m queuing a new build the build does not start staying in the queued queue indefinitely
    do you’ve a tip to found the issue ?

  2. Sometimes it happens that the agent does not communicate with the server. You can simply try to restart the machine with the agent to verify if everything is ok.

    Verify also that the build is scheduled to the right pool where the service is installed.

    Finally check all the logs that you find in the _diag subfolder where you installed the Agent.

Leave a Reply

Your email address will not be published.