Windows – How to make a scheduled task run as a builti-in account

scheduled-taskwindowswindows-server-2003

Windows Server 2003 R2 SP2

How do I configure a scheduled task to run under the credentials of one of the built-in accounts?

I tried SYSTEM, NT AUTRHORITY\SYSTEM, Local Service, NT AUTHORITY\Local Service, to no avail. It asks for a password and if I leave it blank it says 0x080070005 Access is denied.

Best Answer

You don't specify which account you want the task to run as (there are a few BUILTIN accounts). Also you don't mention whether the server is part of a domain or not (domains have some BUILTIN accounts which can be used)

Having said that, on a local server I have here, which is not part of a domain, I managed to create a scheduled task and set it to run as "SYSTEM". After clicking OK (no password - just click OK) and going back into the task, the machine had set it to say NT AUTHORITY\SYSTEM

Bear in mind, SYSTEM is above your Administrator account in terms of permissions, so it's bad practise to run things as this account - better to create a service account for a particular task.

Also of note, is running things as the Network account has no local permissions (it's almost the opposite of the SYSTEM account. Useful for things like IIS.

Editing my post in response to your comment;

Yes, LocalService is completely different from SYSTEM. I've done some reading, and I think you may be stuck trying to get LocalService to run things under 'task scheduler'

See this page - an exerpt below:

The LocalService account is a predefined local account used by the service control manager. This account is not recognized by the security subsystem, so you cannot specify its name in a call to the LookupAccountName function. It has minimum privileges on the local computer and presents anonymous credentials on the network.

I believe you need some local rights to run tasks, which means you need to be recognised by the local security system. Sorry, I think you may be out of luck!

So, to work around, I suggest creating a specifical account for this task and assigning it the lowest permissions you can give it, while allowing it to perform it's task.

Related Topic