Creating Scheduled Task from Group Policy. Can’t write to network share

file-permissionsgroup-policyscheduled-task

I am using NinitePro and group policy to deploy and update software on our small network of 150 Win 7 and WinXP machines. I am roughly following these instructions:
http://community.spiceworks.com/how_to/show/15072-easy-cheap-third-party-patch-management

My setup is as follows. I have a network share I use for deploying software on the network. I created two folders there; bin for a batch file and the NinitePro.exe, and var for Ninite cache files and logs from the batch file.

I then created a gpo linked it to the OU containing my test lab and used security filtering to limit the deployment to just my test lab. In said GPO I created a scheduled task under Computer\preferences\Control Panel\Scheduled Tasks. It just a plain old scheduled task since I have XP clients. I did not specify a user and password under the "Run As:" section so the task runs as NT Authority:System.

This is working so far as Ninite is being called and is updating and installing software, however it is not able to write logs or cache files to the var folder on the network.

How can I set the permissions on the network share so my batch file called from this scheduled task and running as system can write to a network share. Or how should I do this if I have it all wrong. Hope this makes sense. Please ask questions if you need clarification.

Thank you!

Best Answer

Processes running as SYSTEM on domain member computers access network resources as the computer's Active Directory account. Make sure your shared folder is writable by the computer accounts (like, say, "Domain Computers") and you'll be good to go.

tl;dr

My SDDL was incomplete. I needed to add SW (EnumDeps) to the already added LCRPWP permissions in the SDDL.

Long Version

Here is the (sanitized) version of my (broken) SDDL:

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;LCRPWP;;;S-1-1-11-1111111111-1111111111-1111111111-1111)

The problem is in the last clause permissions:

(A;;LCRPWP;;;S-1-1-11-1111111111-1111111111-1111111111-1111)

The SID S-1-1-11-1111111111-1111111111-1111111111-1111 is correct for the group DOMAIN\Tomcat Restarters that DOMAIN\tomcat.restarter is a member of. That much is right. The permissions granted (LCRPWP) are insufficient for Restart-Service.

For the Restart-Service Cmdlet to work it needs the right to Enumerate Dependent Services. In SDDL this is SW (EnumDeps) in the SDDL string. I had LCRPWP which allows QueryStat, Start and Stop.

The correct SDDL for Tomcat 6 for me is:

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;LCSWRPWP;;;S-1-1-11-1111111111-1111111111-1111111111-1111)

The mystery is why Powershell could run Restart-Service from a runas Command Prompt, but not from the Task Scheduler.

I got the necessary revelation from reading @splattered bits answer to his own similar issue with Restart-Service at https://serverfault.com/a/357753/57073.

Windows – Access Denied when creating a scheduled task with powershell and the com schedule.service object

Since Powershell 4.0 you can use the ScheduledTask module to create Scheduled tasks without the use of the com-object and easier reading and writing.

Example:

 $A = New-ScheduledTaskAction -Execute "Taskmgr.exe"
 $T = New-ScheduledTaskTrigger -AtLogon
 $P = New-ScheduledTaskPrincipal "Laptop\Administrator"
 $S = New-ScheduledTaskSettingsSet
 $D = New-ScheduledTask -Action $A -Principal $P -Trigger $T -Settings $S
 Register-ScheduledTask T1 -InputObject $D

The first command uses the New-ScheduledTaskAction cmdlet to assign the variable $A to the executable file tskmgr.exe.

The second command uses the New-ScheduledTaskTrigger cmdlet to assign the variable $T to the value AtLogon.

The third command assigns the variable $P to the principal of the scheduled task, Contoso\Administrator.

The fourth command uses the New-ScheduledTaskSettingsSet cmdlet to assign the variable $S to a task settings object.

The fifth command creates a new task and assigns the variable $D to the task definition.

The sixth command (hypothetically) runs at a later time. It registers the new scheduled task and defines it by using the $D variable.

Dont forget the run the code as Administrator. Source.

Best Answer

Related Solutions

Powershell – Why does powershell -command “Restart-Service Tomcat6” fail when run from a Scheduled Task

tl;dr

Long Version

Windows – Access Denied when creating a scheduled task with powershell and the com schedule.service object

Related Topic