Can group managed service accounts be granted privileges such as “log on as batch job”

The security policy in the Default Domain Controllers Group Policy Object (GPO) doesn't permit unprivileged users to logon interactively or as batch jobs (which is how Scheduled Tasks run) on Domain Controller (DC) computers. Your first problem in making this account unprivileged (which is a good idea) is going to be modifying the security policy.

Your cmd.exe permissions may need to be changed, too, because non-Administrator users are restricted from executing scripts non-interactively in Windows 2003.

Once you've taken care of that you'll also need to sort out making sure that the user account running robocopy actually has rights to read and write to the source and destination locations. Since the account has been privileged in the past you haven't really had to worry about that.

It turns out that you can list all the properties for gMSA by running:

Get-ADServiceAccount -Identity <gMSA-account> -Properties *

And if you want to narrow down the list you can use:

Get-ADServiceAccount -Identity <gMSA-account> -Properties PrincipalsAllowedToRetrieveManagedPassword

It's not very readable, since it's a list of distinguished names and has several other properties listed, but it's a useful command.

Update: to show all the entries from this properties you can use this command, which is shorter and easier to handle that what @Gregory posted

(Get-ADServiceAccount -Identity <gMSA-account> -Properties *).PrincipalsAllowedToRetrieveManagedPassword

You can select specific property, instead of the wildcard *, to decrease the data flowing over the network, but the line becomes prohibitively long due to the verbose name of the property.