?
We're currently running BuildMaster and their agents under the same account. If we can turn off the "agent" role within the Server, it would help us achieve a clear segregation of concerns. We can then narrow the security the server's account runs under and since it won't be doing anything other than coordinating with agents, we can lock down the ports, etc.
Ideailly, we would like to achieve the following:
BuildMaster server (lightweight, has no source control providers, no dependencies installed, does NOT build anything)
BuildMaster build agents (has source control providers, SDK's, etc.)
BuildMaster deploy agents (on the actual target servers the apps should be executing on )