Click here to get back home

Scheduled Tasks - Strange Permissions Issue

 HomeNewsGroups | Search | About
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
Scheduled Tasks - Strange Permissions Issue e v t 11-23-2006
Get Chitika Premium
Posted by e v t on November 23, 2006, 10:32 am
Please log in for more thread options
I have a question about Scheduled Tasks on Windows 2003 Server. I've
got several scheduled tasks that are exhibiting some strange behavior.
They appear to run and don't issue any errors in the scheduled tasks
log, yet they seem to be having permissions problems. Here's an example...

There's a job that's configured to run under a specific user. The user
has "Log on as a service" and "Log on as a batch job" permissions. When
I run the job, no errors are reported in the 'SchedLgU.txt' file.
However, the application that I'm running via the Scheduled Task has its
own log which states, "Access is denied". When I change the user to
'Administrator', the job works just fine. I've tried adding the user
who runs the job into the Administrators group, but this doesn't appear
to work, either. I notice in the Security Event Log that when the job
is run under the other user, the following shows up:

Logon Failure:
        Reason:                An error occurred during logon
        User Name:        task_user
        Domain:                SERVER1C
        Logon Type:        3
        Logon Process:        Ðùl
        Authentication Package:        NTLM
        Workstation Name:        SERVER1C
        Status code:        0xC000006D
        Substatus code:        0x0
        Caller User Name:        -
        Caller Domain:        -
        Caller Logon ID:        -
        Caller Process ID:        -
        Transited Services:        -
        Source Network Address:        192.168.1.20

The only strange thing I can see above is the 'Logon Process' output.
What's up with that?

The scheduled jobs worked fine under Windows 2000. I've been pulling my
hair out over this for the past two days and I know it's got to be
something simple. Can anyone assist, please?

Thanks in advance for any assistance you can provide.

-evt

Posted by Brian Komar [MVP] on November 24, 2006, 8:06 am
Please log in for more thread options
Are the scheduled tasks running a command shell. If they are, you must assi=
gn permissions to=20
Cmd.exe to either the account used to execute the Scheduled task or to the =
Batch group.
Brian

om says...
> I have a question about Scheduled Tasks on Windows 2003 Server. I've=20
> got several scheduled tasks that are exhibiting some strange behavior.=20
> They appear to run and don't issue any errors in the scheduled tasks=20
> log, yet they seem to be having permissions problems. Here's an example.=
..
>=20
> There's a job that's configured to run under a specific user. The user=
=20
> has "Log on as a service" and "Log on as a batch job" permissions. When=
=20
> I run the job, no errors are reported in the 'SchedLgU.txt' file.=20
> However, the application that I'm running via the Scheduled Task has its=
=20
> own log which states, "Access is denied". When I change the user to=20
> 'Administrator', the job works just fine. I've tried adding the user=20
> who runs the job into the Administrators group, but this doesn't appear=
=20
> to work, either. I notice in the Security Event Log that when the job=20
> is run under the other user, the following shows up:
>=20
> Logon Failure:
> =09Reason:=09=09An error occurred during logon
> =09User Name:=09task_user
> =09Domain:=09=09SERVER1C
> =09Logon Type:=093
> =09Logon Process:=09=D0=F9l=01
> =09Authentication Package:=09NTLM
> =09Workstation Name:=09SERVER1C
> =09Status code:=090xC000006D
> =09Substatus code:=090x0
> =09Caller User Name:=09-
> =09Caller Domain:=09-
> =09Caller Logon ID:=09-
> =09Caller Process ID:=09-
> =09Transited Services:=09-
> =09Source Network Address:=09192.168.1.20
>=20
> The only strange thing I can see above is the 'Logon Process' output.=20
> What's up with that?
>=20
> The scheduled jobs worked fine under Windows 2000. I've been pulling my=
=20
> hair out over this for the past two days and I know it's got to be=20
> something simple. Can anyone assist, please?
>=20
> Thanks in advance for any assistance you can provide.
>=20
> -evt
>=20

Posted by e v t on November 24, 2006, 10:36 am
Please log in for more thread options
No, not that I know of. I did know about this issue and assigned that
user the right security permissions on cmd.exe. The jobs are all
calling an executable which does the dirty work.

-eric

Brian Komar [MVP] wrote:
> Are the scheduled tasks running a command shell. If they are, you must assign
permissions to
> Cmd.exe to either the account used to execute the Scheduled task or to the
Batch group.
> Brian
>
says...
>> I have a question about Scheduled Tasks on Windows 2003 Server. I've
>> got several scheduled tasks that are exhibiting some strange behavior.
>> They appear to run and don't issue any errors in the scheduled tasks
>> log, yet they seem to be having permissions problems. Here's an example...
>>
>> There's a job that's configured to run under a specific user. The user
>> has "Log on as a service" and "Log on as a batch job" permissions. When
>> I run the job, no errors are reported in the 'SchedLgU.txt' file.
>> However, the application that I'm running via the Scheduled Task has its
>> own log which states, "Access is denied". When I change the user to
>> 'Administrator', the job works just fine. I've tried adding the user
>> who runs the job into the Administrators group, but this doesn't appear
>> to work, either. I notice in the Security Event Log that when the job
>> is run under the other user, the following shows up:
>>
>> Logon Failure:
>>         Reason:                An error occurred during logon
>>         User Name:        task_user
>>         Domain:                SERVER1C
>>         Logon Type:        3
>>         Logon Process:        Ðùl
>>         Authentication Package:        NTLM
>>         Workstation Name:        SERVER1C
>>         Status code:        0xC000006D
>>         Substatus code:        0x0
>>         Caller User Name:        -
>>         Caller Domain:        -
>>         Caller Logon ID:        -
>>         Caller Process ID:        -
>>         Transited Services:        -
>>         Source Network Address:        192.168.1.20
>>
>> The only strange thing I can see above is the 'Logon Process' output.
>> What's up with that?
>>
>> The scheduled jobs worked fine under Windows 2000. I've been pulling my
>> hair out over this for the past two days and I know it's got to be
>> something simple. Can anyone assist, please?
>>
>> Thanks in advance for any assistance you can provide.
>>
>> -evt
>>

Posted by Roger Abell [MVP] on November 24, 2006, 3:46 pm
Please log in for more thread options
I have seen that odd, unicode-ish, proc id in these failure events
on W2k3 R2 systems. In each case I have tracked it only so
far as due to excessive network restrictions (ipsec, firewall)
on communications either by the machine with itself or with
the domain controllers. I have not pinned it down to exactly
what, which protocol/ports. Similarly when I last attempted
searches for info on the failure with odd logon process id,
I turned up nothing specific.


>I have a question about Scheduled Tasks on Windows 2003 Server. I've got
>several scheduled tasks that are exhibiting some strange behavior. They
>appear to run and don't issue any errors in the scheduled tasks log, yet
>they seem to be having permissions problems. Here's an example...
>
> There's a job that's configured to run under a specific user. The user
> has "Log on as a service" and "Log on as a batch job" permissions. When I
> run the job, no errors are reported in the 'SchedLgU.txt' file. However,
> the application that I'm running via the Scheduled Task has its own log
> which states, "Access is denied". When I change the user to
> 'Administrator', the job works just fine. I've tried adding the user who
> runs the job into the Administrators group, but this doesn't appear to
> work, either. I notice in the Security Event Log that when the job is run
> under the other user, the following shows up:
>
> Logon Failure:
> Reason: An error occurred during logon
> User Name: task_user
> Domain: SERVER1C
> Logon Type: 3
> Logon Process: Ðùl
> Authentication Package: NTLM
> Workstation Name: SERVER1C
> Status code: 0xC000006D
> Substatus code: 0x0
> Caller User Name: -
> Caller Domain: -
> Caller Logon ID: -
> Caller Process ID: -
> Transited Services: -
> Source Network Address: 192.168.1.20
>
> The only strange thing I can see above is the 'Logon Process' output.
> What's up with that?
>
> The scheduled jobs worked fine under Windows 2000. I've been pulling my
> hair out over this for the past two days and I know it's got to be
> something simple. Can anyone assist, please?
>
> Thanks in advance for any assistance you can provide.
>
> -evt



Posted by e v t on November 27, 2006, 9:08 am
Please log in for more thread options
Hi Roger,
Thanks for the info. What I don't understand is why it works perfectly
when the task is run as Administrator. I've tried assigning the account
I'm using to be in the Administrators group, removing all other groups,
and assigning the permissions in Local Security Policy. I'm trying to
figure out what other permissions the Administrator has that are not
obvious. Does this make sense?

-eric

Roger Abell [MVP] wrote:
> I have seen that odd, unicode-ish, proc id in these failure events
> on W2k3 R2 systems. In each case I have tracked it only so
> far as due to excessive network restrictions (ipsec, firewall)
> on communications either by the machine with itself or with
> the domain controllers. I have not pinned it down to exactly
> what, which protocol/ports. Similarly when I last attempted
> searches for info on the failure with odd logon process id,
> I turned up nothing specific.
>
>
>> I have a question about Scheduled Tasks on Windows 2003 Server. I've got
>> several scheduled tasks that are exhibiting some strange behavior. They
>> appear to run and don't issue any errors in the scheduled tasks log, yet
>> they seem to be having permissions problems. Here's an example...
>>
>> There's a job that's configured to run under a specific user. The user
>> has "Log on as a service" and "Log on as a batch job" permissions. When I
>> run the job, no errors are reported in the 'SchedLgU.txt' file. However,
>> the application that I'm running via the Scheduled Task has its own log
>> which states, "Access is denied". When I change the user to
>> 'Administrator', the job works just fine. I've tried adding the user who
>> runs the job into the Administrators group, but this doesn't appear to
>> work, either. I notice in the Security Event Log that when the job is run
>> under the other user, the following shows up:
>>
>> Logon Failure:
>> Reason: An error occurred during logon
>> User Name: task_user
>> Domain: SERVER1C
>> Logon Type: 3
>> Logon Process: Ðùl
>> Authentication Package: NTLM
>> Workstation Name: SERVER1C
>> Status code: 0xC000006D
>> Substatus code: 0x0
>> Caller User Name: -
>> Caller Domain: -
>> Caller Logon ID: -
>> Caller Process ID: -
>> Transited Services: -
>> Source Network Address: 192.168.1.20
>>
>> The only strange thing I can see above is the 'Logon Process' output.
>> What's up with that?
>>
>> The scheduled jobs worked fine under Windows 2000. I've been pulling my
>> hair out over this for the past two days and I know it's got to be
>> something simple. Can anyone assist, please?
>>
>> Thanks in advance for any assistance you can provide.
>>
>> -evt
>
>

Similar ThreadsPosted
Scheduled tasks "Could not start" May 2, 2006, 10:09 am
Windows 2003 scheduled tasks April 10, 2006, 2:05 pm
How to allow non-admin to run scheduled tasks remotely? July 24, 2008, 1:18 pm
AT command and Scheduled tasks UI for non-admin users January 20, 2006, 9:08 am
Allow non-admin to create/edit scheduled tasks May 23, 2007, 4:41 pm
Strange issue with ACL September 26, 2005, 7:21 pm
Strange issue with password authentication January 18, 2007, 10:58 am
Windows Server 2003 - Services Permissions Issue August 29, 2005, 1:28 pm
Security on Tasks Folder April 24, 2006, 11:23 am
mass change passwords on tasks October 17, 2006, 10:23 pm

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap