What are the minimum permissions needed to run a Scheduled Task on Server 2003

permissionsscheduled-taskwindows-server-2003

I'm trying to set up a scheduled task on my server 2003 box (that is sitting on the WWW) to read web logs into a database.

When I run the .cmd file that I have set up using runas, the task succeeds. However, when I try to schedule the task under the user, I get the following error:

"ImportToday.job" (ImportToday.cmd) 9/15/2010 2:37:30 PM ** ERROR **
    Unable to start task.
    The specific error is:
    0x80070005: Access is denied.
    Try using the Task page Browse button to locate the application.

Adding the account logimporter into the Administrators group lets the scheduled task succeed, but this is really not a long-term option.

I have tried adding the Log on as a service right, and the account currently has the Log on as a batch job right.

What do I need to do?

Best Answer

And..... I found it.

By default, CMD.EXE requires special permissions when not logged on to a desktop session.

So, by adding Read and Read & Execute permissions for the account has fixed my problem.

That is:

cacls C:\Windows\system32\cmd.exe /e /g logimporter:r

fixed it for me.

Related Solutions

Windows Scheduled Tasks – Fixing ‘Access Denied’ Error

OK Guys, this issue plagued me for some time. I finally found a solution and would like to share.

Warning! The following solution involves the Windows System Registry. Editing or manipulating the registry incorrectly can result in serious system damage which may require reinstallation of the operating system. If you are not comfortable editing the registry, then take your system to a professional. If you choose to proceed, then it is essential that you create a complete system backup and a Windows System Restore Point before proceeding.

First download subinacl from Microsofts web site and run the installation package. http://www.microsoft.com/downloads/details.aspx?FamilyID=E8BA3E56-D8FE-4A91-93CF-ED6985E3927B&displaylang=en

SubInACL is a command-line tool that enables administrators to obtain security information about files, registry keys, and services, and transfer this information from user to user, from local or global group to group, and from domain to domain.

Next copy and paste the following command to a text file. Save the file as reset.cmd. Once saved double click the file and the commands will begin to run. This process takes anywhere from 3 to 10 minutes of time. After it has run, there will be no restart required in most cases(Oracle I found to be a different story). Proceed with scheduling task or whatever you were doing before getting the dreaded "Access Denied" Error. Hope this helps!

cd /d "%ProgramFiles%\Windows Resource Kits\Tools"
subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f /grant=system=f
subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f /grant=system=f
subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f /grant=system=f
subinacl /subdirectories %SystemDrive% /grant=administrators=f /grant=system=f
subinacl /subdirectories %windir%\*.* /grant=administrators=f /grant=system=f
secedit /configure /cfg %windir%\repair\secsetup.inf /db secsetup.sdb /verbose

Windows – cwrsync on Server 2008 R2 as a scheduled task

Windows Scheduled Tasks run as a special system user by default (can't remember the exact name, something like LocalSystem?), but that user typically does not have the same environment or privileges as a regular user of the system. Without knowing more detail, it is difficult to tell what is actually going wrong with your Task, so I'll just mention a couple of ideas.

It is possible that your batch script accesses a mapped drive letter that is only defined to you, and so the script fails when run as the special "Scheduled Task" user. Another possibility is that your script accesses network shares, and I believe that the "Scheduled Task" user does not normally have the privilege to access those.

Finally, you could try redirecting the output of the commands in your batch script to a text file. That could be as simple as appending something like >> C:\myscriptlogfile.txt to every line in your script. Examining the output of a failed run may give you some clues about what is going wrong.

Best Answer

Related Solutions

Windows Scheduled Tasks – Fixing ‘Access Denied’ Error

Windows – cwrsync on Server 2008 R2 as a scheduled task

Related Topic