"Log on as batch job" should be all the account needs to run a simple task on the DC. How did you give the account that permission? In a vanilla 2008 R2 AD, that privilege is configured in the Default Domain Controllers Policy GPO to include:
- BUILTIN\Performance Log Users
- BUILTIN\Backup Operators
- BUILTIN\Administrators
In order to add a user or group to that list, you'd either have to edit that policy or create a new policy to override that setting. Since editing MS default policies is a bad idea, you should create a new policy with the setting overridden. Make sure you include the default groups listed above as well as the user you're trying to give access to. This particular setting gets overwritten (rather than merged) if there are multiple policies trying to configure it.
i´ve been trying hard to make similar software run OK when you choose:
Run whether user is logged on or not
It resulted with 2 different software (SyncBack and synctoy) that the problems were in both cases third party soft related problems (not soft problems but things to take into account).
As an example, if you created a Task to run:
"C:\Program Files (x86)\Rock Gym Pro\Backup.exe"
as domain\user1 , With some parameters lik -R "MyBackup", but you configured the task from another user like domain\administrator,
and also set "parameters like -R "MyBackup"" as administrator, software creates "MyBackup" config file under administrator folders (usr/administrator/appdata/roaming/...), so when the task executes as doman\user1 , the program search for "Mybackup" config file in user1 folder.
As result, no file exist in user1 appdata or whatever folders, because you never configured the software from user1, so nothing happen.
To solve this, you have to logon as that user, in the server, in order the folders be created, test the script from that user (If you want with scheduled task, with the "Run whether user is logged on or not" option activated,), and then you configure the task from administrator user and then set to run as user1.
That way when task run the software will find the "MyBackup" files and execute with no problem.
That was my problem, hard to find because there weren´t logs of this anywhere (or i couldn´t find them), just nothing happened when you run the task and finally says "Task Executed Successfuly".
Please let me know if i helped...Sorry my english im from Argentina.
Best Answer
I had the same issue. I turned out that I needed to change the default domain controller group policy to allow the gmsa account to logon as a service.