Powershell – Scheduling a one-time task to run on Windows Server 2012R2 boot

powershellscheduled-taskwindows-server-2008-r2

As part of a system build automation script (that I'm using to create AWS AMIs), I want the system to reboot and then run additional post-boot setup tasks – but only once (so that when the system is imaged and then the image used to start a new instance, it will not run the post-boot setup tasks again).

The way I started to implement this is that the initial setup script (written in Powershell) uses Register-ScheduleJob -Trigger (New-JobTrigger -AtStartup) ... -Name PostBootSetup to setup another Powershell script run immediately after boot. In the post-boot script, I have:

Get-JobTrigger -Name PostBootSetup | ?{$_.Enabled} | Disable-JobTrigger

But when it is run I get this error (I'm logging all output of the post-boot script to a file):

Powershell : A scheduled job definition with Name PostBootSetup could not be found.

Which is weird because that is the output from the job that is currently running. I've also added just plain calls to Get-ScheduledJob and Get-JobTrigger -Name PostBootSetup that should output the relevant records, but there is absolutely no output from these – even though if I run these commands on a Powershell console after the machine started, I get the expected output.

Is it possible that a job can't access its own scheduled job record while running? If so, is there a workaround? or am I missing something? If this is not a good method to go about doing a one-time post-boot job, what would you suggest?

As a further note, I'm not very comfortable in batch, so I'd appreciate solutions that use Powershell or .Net or something that is more expressive than batch.

Best Answer

Use one of the RunOnce registry keys, they were designed for exactly this kind of task.
They run once, and then disappear.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

Make a new string value key where the name is whatever, and the data is the CLI EXE and switches to what you want run.
https://msdn.microsoft.com/en-us/library/windows/desktop/aa376977%28v=vs.85%29.aspx

PS C:\> new-itemproperty -path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce -name "myInstall" -value '"c:\temp\borland\setup.exe" /this /that /other'

Related Solutions

How to Run a .bat File in a Scheduled Task Without a Window

You could run it silently using a Windows Script file instead. The Run Method allows you running a script in invisible mode. Create a .vbs file like this one

Dim WinScriptHost
Set WinScriptHost = CreateObject("WScript.Shell")
WinScriptHost.Run Chr(34) & "C:\Scheduled Jobs\mybat.bat" & Chr(34), 0
Set WinScriptHost = Nothing

and schedule it. The second argument in this example sets the window style. 0 means "hide the window."

Complete syntax of the Run method:

 object.Run(strCommand, [intWindowStyle], [bWaitOnReturn])

Arguments:

object: WshShell object.
strCommand: String value indicating the command line you want to run. You must include any parameters you want to pass to the executable file.
intWindowStyle: Optional. Integer value indicating the appearance of the program's window. Note that not all programs make use of this information.
bWaitOnReturn: Optional. Boolean value indicating whether the script should wait for the program to finish executing before continuing to the next statement in your script. If set to true, script execution halts until the program finishes, and Run returns any error code returned by the program. If set to false (the default), the Run method returns immediately after starting the program, automatically returning 0 (not to be interpreted as an error code).

Powershell – Why does powershell -command “Restart-Service Tomcat6” fail when run from a Scheduled Task

tl;dr

My SDDL was incomplete. I needed to add SW (EnumDeps) to the already added LCRPWP permissions in the SDDL.

Long Version

Here is the (sanitized) version of my (broken) SDDL:

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;LCRPWP;;;S-1-1-11-1111111111-1111111111-1111111111-1111)

The problem is in the last clause permissions:

(A;;LCRPWP;;;S-1-1-11-1111111111-1111111111-1111111111-1111)

The SID S-1-1-11-1111111111-1111111111-1111111111-1111 is correct for the group DOMAIN\Tomcat Restarters that DOMAIN\tomcat.restarter is a member of. That much is right. The permissions granted (LCRPWP) are insufficient for Restart-Service.

For the Restart-Service Cmdlet to work it needs the right to Enumerate Dependent Services. In SDDL this is SW (EnumDeps) in the SDDL string. I had LCRPWP which allows QueryStat, Start and Stop.

The correct SDDL for Tomcat 6 for me is:

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;LCSWRPWP;;;S-1-1-11-1111111111-1111111111-1111111111-1111)

The mystery is why Powershell could run Restart-Service from a runas Command Prompt, but not from the Task Scheduler.

I got the necessary revelation from reading @splattered bits answer to his own similar issue with Restart-Service at https://serverfault.com/a/357753/57073.