Optional username/password credentials for the account the inbound agent Windows service runs as. Use DOMAIN\user or user@domain.com for a domain account, or user for a local account. The sample script creates the local account with the credential's password if it does not already exist in the image.

Only supported for Windows templates using the inbound launcher with an init script. The inbound launcher and custom init scripts are only available when "Use Advanced Image Configurations" is selected. The username and password are passed Base64-encoded as the 4th and 5th init script arguments through the extension's encrypted protected settings. If an agent workspace is configured, it is passed Base64-encoded as the 6th argument so the script can grant the account write access to it. The init script must apply them to the agent service; see the sample.

Use a dedicated, least-privileged account and update the Jenkins credential whenever its password changes.

The agent no longer runs as SYSTEM, so builds only have the permissions of this account. Your init script must grant the account any additional permissions your builds need, such as local group membership (for example Administrators), access to other folders, or rights to install software. The sample script only grants "Log on as a service" and write access to the agent and workspace folders.