The AI Now Knows When an Agent Isn't an Administrator ​

October 1, 2026 · InfraScout Team

Once agents can run as a gMSA on Windows or without root on Linux, some commands are supposed to fail. A time-service change on a domain controller or a certificate template ACL simply needs more than a least-privilege account holds. Until now the AI found that out the hard way, often from an "Access is denied" buried in output that otherwise looked successful. Now each agent says at startup whether it has administrator rights, and the AI plans around the answer before it runs anything.

The AI Plans Around It Up Front ​

When the AI lists or looks up agents, it now sees whether each one is an administrator on its host. For an agent that isn't, it knows that admin-only commands will come back with Access denied. It tells you at the start which of the checks you asked for it cannot run on that host, and it carries on with the ones it can. You no longer have to piece the gaps together from errors halfway through an assessment.

That makes a mixed fleet easy to reason about in chat:

text
Audit time synchronization on all domain controllers. Before you start,
tell me which hosts can't run the admin-only checks and what we'd miss there.

What counts as "administrator" depends on the platform. On Windows, the agent is an administrator when it runs as SYSTEM, or when the local Administrators group is an enabled group for the account it runs as. A gMSA that you deliberately added to local Administrators therefore counts as admin, and one that you didn't add doesn't. On Linux, macOS and FreeBSD, the agent is an administrator when it runs as root.

Admin or Limited, Next to Runs As ​

Agent Details now shows an Admin or Limited badge next to Runs as, so you can confirm at a glance what a host's agent can reach.

No badge means the value is unknown. Usually the agent is older than this release, and occasionally it couldn't read its own account's rights. Unknown is never the same as "not an administrator", and the AI doesn't treat it that way either. Agents start reporting the value once they update, and the server and the agent can update in either order.

Runs as itself now appears on macOS and FreeBSD hosts too. Before this release it was reported only on Windows and Linux.

The Agent Log Says Why a Capability Is Missing ​

Under a gMSA, the agent can lose capabilities such as reading the Security event log, reading performance counters or ETW tracing until its account joins the right local group. The agent always probed these capabilities, but when a probe failed, nothing recorded why. The agent log now names the reason, such as access denied when opening the Security log. It logs each capability once when its status changes: when a probe first fails, when the reason changes, and when it passes again. This makes it easy to tell a missing group membership from a broken host, without filling the log on every reconnect. The capabilities reference lists which group each capability needs.

Service Commands Find Their Own Configuration ​

If you install or migrate agents under a gMSA by hand, the Windows service commands now ask less of you. agent service install and agent service set-account no longer need --config spelled out. By default they use the configuration that enrollment wrote, %ProgramData%\InfraScout\agent-config.yaml on Windows and /etc/infrascout/agent-config.yaml elsewhere. On Windows hosts enrolled earlier, with the configuration next to the agent binary, they read the path that the installed service is already registered with.

powershell
# Move an enrolled host onto its gMSA — no --config needed
agent service set-account "CONTOSO\gmsaISMember$"

# And back to LocalSystem
agent service set-account --local-system

When a command refuses, it now tells you what to do. A mistyped --serviceaccount suggests --service-account. Running start before install tells you to run install first. Passing SYSTEM as an account name points you to set-account --local-system, which is the only way to choose LocalSystem. The CLI reference covers every flag.

A More Compact Fleet Grid ​

Agent cards on the fleet grid and in the admin agent view now collapse their capabilities into a single Capabilities: n row that you can expand. The grid fits more hosts on one screen. The table view and Agent Details still list every capability in full. See Agents for the rest of the view.

More detail: Run the Windows Agent Under a gMSA and Run the Linux Agent Without Root.

Questions or feedback? Reach us at info@infrascout.cloud.