As part of a recovery action in Advanced Alerting Engine I would like to execute a third party program. I am having trouble getting it to execute and am wondering what security context / user ID those actions are executed as?
Check the SolarWinds Alerting Engine to see which account it's using. By default, it's using the Local System account. You should be able to change the account that it uses to run but keep in mind that it probably won't be supported by SolarWinds.