Drop puppet privileges on windows - Inspect the list of windows services and check if puppet is marked to run as LocalService - if it ins't, then reconfigure it to use this account and then reboot. This will drop privileges (eg from a domain account)

dropprivs.pp

  # Note  When changing a service from a local system to a network, or 
  # from a network to a local system, StartPassword must be an empty 
  # string ("") and not NULL.
  # https://msdn.microsoft.com/en-us/library/aa384901%28v=vs.85%29.aspx?f=255&MSPPError=-2147217396
  $ps = '(gwmi win32_service  -filter "name=\'puppet\'").change($null,$null,$null,$null,$null,$null,"LocalSystem","")'

  $st = 'if ((gwmi win32_service  -filter "name=\'puppet\'").StartName -eq "LocalSystem") { exit 0 } else {exit 1}' 

  exec { "drop_puppet_service_privs":
    provider => powershell,
    command => $ps,
    unless  => $st,
    notify  => Reboot["after_agent_drop_privs"],
  }
  

  reboot { "after_agent_drop_privs":}