Preparing Jenkins Nodes for Running Tests

1. Enable Remote Desktop connections

2. Configure group policies

3. Disable secure sign-in

4. Disable additional screens

5. Run Jenkins agents in interactive mode

6. Provide elevated permissions for TestExecute

By default, computers prohibit remote connections. For Jenkins to be able to connect to nodes and open user sessions on them:

1. On your Jenkins node, set the System properties > Remote > Remote Desktop option to:

   • In Windows 10 and Windows 8.1 – Allow remote connections to this computer.

   • In Windows 7 – Allow connections from computers running any version of Remote Desktop (less secure).

2. Add a user account under which you will run tests on the node to the Remote Desktop Users group.

3. Make sure that the user account has a non-empty password.

Otherwise, Jenkins will not be able to connect to the node and run TestComplete tests on it.

To be able to connect to nodes and open a user session on them, configure the following group policies on the nodes:

1. On the Jenkins node, open the Group Policy editor (type gpedit.msc in the Search dialog and press Enter).

2. Disable the following policies:

   • Always prompt client for password upon connection

   • Prompt for credentials on the client computer

   To disable these policies

   To disable these policiesTo disable these policies

   1. In the tree on the left of the Group Policy editor, select the following category:

      On Windows 10, Windows 8.1, Windows 7 and Windows Server 2012:

      Local Computer Policy > Computer Configuration > Administrative Templates > All Settings

      On Windows Vista and Windows Server 2008:

      Local Computer Policy > Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security

   2. In the list on the right, double-click the Always prompt client for password upon connection item.

      Click Disabled and then click OK.

   3. Repeat step 2 for the Prompt for credentials on the client computer item.

   If the computer belongs to a domain, you may need to ask your system administrator to disable these policies on the domain controller as well.

3. If the node is running under Windows 10, enable the Require use of specific security layer for remote (RDP) connections group policy and set the security layer to Negotiate.

   To configure the group policy

   To configure the group policyTo configure the group policy

   1. In the tree on the left of the Group Policy editor, select Local Computer Policy > Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security.

   2. In the Setting list on the right, double-click the Require use of specific security layer for remote (RDP) connections item.

   3. In the subsequent dialog, click Enabled.

   4. In the Security Layer drop-down list of the dialog, select Negotiate.

   5. Click OK to close the dialog and save the changes.

4. If the node is running under a non-server edition of Windows and it has other users logged in, log off those users.

5. If the node is running under a server edition of Windows, enable the following policy:

   • Require use of specific security layer for remote (RDP) connections (on Windows Server 2016 or Windows Server 2019)

   • Restrict Remote Desktop Services users to a single Remote Desktop Services session (on Windows Server 2012 or Windows Server 2008)

   • Restrict Terminal Services users to a single remote session (on Windows Server 2003)

   To enable the needed policy on Windows Server 2016 or Windows Server 2019

   To enable the needed policy on Windows Server 2016 or Windows Server 2019To enable the needed policy on Windows Server 2016 or Windows Server 2019

   1. In the tree on the left of the Group Policy editor, select Local Computer Policy > Computer Configuration > Administrative Templates > Windows Components.

   2. Then, select Remote Desktop Services > Remote Desktop Session Host > Security.

   3. In the Setting list on the right, double-click the Require use of specific security layer for remote (RDP) connections item.

   4. In the subsequent dialog, click Enabled.

   5. In the Security Layer drop-down list of the dialog, select Negotiate.

   6. Click OK to close the dialog and save the changes.

   To enable the needed policy on Windows Server 2008 and later

   To enable the needed policy on Windows Server 2008 and laterTo enable the needed policy on Windows Server 2008 and later

   1. In the tree on the left of the Group Policy editor, select Computer Configuration > Administrative Templates > Windows Components.

   2. Then select Remote Desktop Services > Remote Desktop Session Host > Connections.

   3. In the list on the right, double-click the Restrict Remote Desktop Services users to a single Remote Desktop Services session item.

   4. Click Enabled and click OK.

   To enable the needed policy on Windows Server 2003

   To enable the needed policy on Windows Server 2003To enable the needed policy on Windows Server 2003

   1. In the tree on the left of the Group Policy editor, select Computer Configuration > Administrative Templates > Windows Components.

   2. Then select Terminal Services.

   3. In the list on the right, double-click the Restrict Terminal Services users to a single remote session item.

   4. Click Enabled and click OK.

   If the node is running in Remote Administration Server mode and there are user sessions opened on it, close unnecessary sessions.

6. If the node is configured to show a logon message when a user logs on, disable the message.

   To disable the message

   To disable the messageTo disable the message

   1. In the tree on the left of the Group Policy editor, select Configuration > Windows Settings > Security Settings > Local Policies > Security Options.

   2. In the list on the right, double-click the Interactive logon: Message title for users attempting to log on item.

   3. In the resulting dialog, set the title of the logon message to an empty string and click OK to save the changes.

   4. Then, right-click the Interactive logon: Message text for users attempting to log on item.

   5. Set the text of the logon message to an empty string and click OK.

   If the message persists

   If the message persistsIf the message persists

   1. On the node, open the Registry editor (type regedit in the Search dialog and press Enter).

   2. Navigate to the following registry key:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

   3. Make sure that its LegalNoticeCaption and LegalNoticeText values are set to an empty string.

You can check whether the node is configured correctly by connecting to it manually. If it does not show any additional messages or prompts, the group policies are configured correctly. Otherwise, you may need to ask your system administrator to disable those messages.

Sometimes, Windows is configured so that the user has to press Ctrl+Alt+Delete before signing in to prevent unwanted actions the software that simulates user behavior may perform. TestExecute does not provide any means to work around this feature, so we recommend you to turn it off:

1. On the target node, press Win+R to open the Run dialog.

2. Type control userpasswords2 and press Enter.

3. In the subsequent User Accounts dialog, switch to the Advanced tab.

4. Clear the Require users to press Ctrl+Alt+Delete check box.

5. Click OK or Apply.

To avoid issues during the testing, make sure that when you connect to the remote machine its desktop opens up immediately — that is, no additional screens appear (such as the login form, account selection window, or RDP Certificate Warning windows). To learn how to disable these additional screens, contact your IT department.

If the Jenkins agent is running as a Windows application (launched via Java Web Start), TestExecute will run under a user account and will be able to interact with GUI elements.

If the Jenkins agent runs as a service under a non-interactive system account (for instance, Local System), TestExecute will run under the non-interactive account as well. As a result, TestExecute will not have access to the user interface on the computer and will not be unable to simulate user actions. Your automated tests that simulate user actions against GUI elements will fail.

To allow tests to interact with GUI elements and avoid possible issues, configure your TestComplete Test build steps to open an interactive user session in which they will run:

• If you use Freestyle Jenkins jobs - See the description of the Run interactive user session option of the TestComplete Tests build step.

• If you use Pipeline - See the description of the useTCService parameter of the step.

If your tests do not interact with GUI and no interactive session is required, configure TestExecute on the agent to run with UI accessibility disabled. See Preparing Jenkins for Running TestComplete Tests.

On Windows 8.1 and later, TestExecute requires elevated permissions for the run. If the Jenkins agent is running as an application, it cannot start TestExecute with required permissions. This may cause the TestComplete Test step to fail.

To run tests under Windows 8.1 and later, do any of the following:

• Run the Jenkins agent as a service. As a service, the agent has the required permissions and can start TestExecute with the required permissions as well.

  Make sure that the TestComplete Test build step is configured to open an interactive user session on the node.

– or –

• On the Jenkins nodes, disable support for testing Windows Store applications in TestExecute. With this option disabled, TestExecute can be run without elevated permissions.