Running Scheduled Tasks Remotely Without Full Administrator Rights

Discussion in 'Windows Server' started by Ryan, Feb 16, 2007.

  1. Ryan

    Ryan Guest

    I'm trying to setup a user to be able to run a scheduled task on a remote
    server using the following command:

    schtasks /run /s MyServer /TN MyTask

    Of course, this works fine if I make the user a local administrator on the
    server hosting the scheduled task. But...I don't want this user to have full
    administrator rights on the server.

    I gave the user read/execute permissions on the security tab for the task
    itself. I've also given the user "Log on as a batch job" permissions in the
    local security policy, but I am still getting an "ERROR: Access is denied."
    message.

    As a work around I also tried giving a test user RDP access to the server to
    see if that would do the trick, but I get an "Access is denied" message when
    I click on the Scheduled Tasks icon in the control panel.

    Anyone have any ideas on this one?
     
    Ryan, Feb 16, 2007
    #1
    1. Advertisements

  2. hi,
    try to create the scheduled task with the test user.
     
    Dragos CAMARA, Feb 17, 2007
    #2
    1. Advertisements

  3. Matt Callaghan, May 14, 2007
    #3
  4. Ryan

    Herb Martin Guest

    What if you give the user "Run as Batch" right explicitly?

    This should work to Schedule and RUN the task locally (in the Task
    Scheduler)
    but the user may need more privilege depending on what the task actually
    does.
     
    Herb Martin, May 14, 2007
    #4
  5. One thing to note however is that users are REMOTELY scheduling tasks (over
    the network).

    Where is "Run as Batch"?
    .... I don't see it as a group.
     
    Matt Callaghan, May 14, 2007
    #5
  6. Ryan

    Herb Martin Guest

    It is not -- it is a Right. But you might create such a Group, give the
    right, and make it easy to give the right by adding someone to the
    group (if you don't already have users in a large number of groups.)

    Check RIGHTS not groups.
     
    Herb Martin, May 15, 2007
    #6
  7. Adding the user to the "Log on as Batch" group policy does not allow them to
    schedule tasks still....

    What else can we try?
     
    Matt Callaghan, May 15, 2007
    #7
  8. Ryan

    Herb Martin Guest

    Run as Batch. There is no Logon as Batch unless you created that.
    See if they can schedule a batch locally. The remote scheduler may require
    admin (like) privileges.
     
    Herb Martin, May 15, 2007
    #8
  9. Hi Herb,
    Thanks for continuing to reply;

    I think this is the problem, windows by default requires administrator
    rights to be able to remotely schedule tasks to be run on a server.

    What I'm trying to determine is if there is a group policy object somewhere
    that we can set which would allow a certain set of users (i.e. members of
    group "Task Schedulers" for example) to schedule tasks to be run as "System"
    without being an administrator.


    PS: I still don't understand what you mean by : "Run as Batch". Could you
    please give a specific example as to how I can allow a user this privilege?
     
    Matt Callaghan, May 16, 2007
    #9
  10. Ryan

    Herb Martin Guest

    Run as Batch is a RIGHT, like Logon Locally, or Change System Time.

    You can set this in the Local settings of Computer Management or for many
    computers/users through a Group Policy in the Computer->Security settings.

    There is some right that is sufficient for setting the Task to run remotely,
    there
    has to be because that is how Admins do it. Whether this is a "single"
    right
    or a bunch of them that would practically make the remote person an admin
    I do not know, but if you haven't given the users "Run as Batch" yet then
    you have NOT really tested it.
     
    Herb Martin, May 16, 2007
    #10
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.