itch sandbox and Windows user account's security policies

I’ve tried to setup itch sandbox on Windows Server 2016 Technical Preview 5, but it was unsuccessful. I’ve checked “Enable itch.io sandbox”, then tried to run a game, got a popup asking if I’m OK with performing first-time sandbox setup, agreed, entered administrator password, and then got an itch launch error message: error(s) while installing sandbox: Error: adminRunScript failed with code 1.

I’ve tried to run net user itch-player salt /add manually, and got a message that the password doesn’t meet password policy requirements. Apparently the system had enabled the policy for strong passwords, which can be found in Local Security Policy applet as Security Settings -> Account Policies -> Password Policy -> Password must meet complexity requirements. Exact requirements from the setting’s description:

Not contain the user's account name or parts of the user's full name that exceed two consecutive characters
Be at least six characters in length
Contain characters from three of the following four categories:
English uppercase characters (A through Z)
English lowercase characters (a through z)
Base 10 digits (0 through 9)
Non-alphabetic characters (for example, !, $, #, %)
Complexity requirements are enforced when passwords are changed or created.

Clearly the password salt violates this policy. After disabling the policy itch app was able to perform setup and run a game under sandbox. Note that this particular policy was enabled by default on my system (presumably because it’s server edition).

I guess the simplest fix would be to hardcode some acceptable password like PleaseN0tAgainWindows! instead of salt. However there’re some other policies related to password, like password length/age limits - they were disabled by default, but someone may have them enabled. Probably itch has to regenerate password from time to time?

[GranPC]

So, isolate could be fixed if we passed explicitly which user the sandbox is for afaict?

Yup, that should do the trick. I’ll start testing against this scenario and roll out a fix soon. Thanks for testing @quyse!

[fasterthanlime]

@quyse I started seeing the exact same behavior a few days ago!

.@granpc & I are working on a fix (ie. rotating the password as needed).