Re: Remote Task Scheduler access problem

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

Hi,

I'm sorry for any inconvenience and confusion it brought you. Actually,
this feature is make sense, I think.

I hope the information I provided is helpful for you. If you have any other
issues, please feel free to post in our newsgroup. I'm glad to provide
assistance.

Have a good day!


Best regards,

Vincent Xu
Microsoft Online Partner Support

======================================================
Get Secure! - www.microsoft.com/security
======================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others
may learn and benefit from this issue.
======================================================
This posting is provided "AS IS" with no warranties,and confers no rights.
======================================================



--------------------
From: "Brian L." <699df88b-2059788708@xxxxxxxxxxxxxx>
References: <OIZCNLbhGHA.4252@xxxxxxxxxxxxxxxxxxxx>
<WA0J3ighGHA.464@xxxxxxxxxxxxxxxxxxxxx>
Subject: Re: Remote Task Scheduler access problem
Date: Fri, 2 Jun 2006 07:36:26 -0400
Lines: 151
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2869
X-RFC2646: Format=Flowed; Original
Message-ID: <uoaXJjjhGHA.5104@xxxxxxxxxxxxxxxxxxxx>
Newsgroups: microsoft.public.windows.server.general
NNTP-Posting-Host: 204-60-67-237.connecticare.com 204.60.67.237
Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP04.phx.gbl
Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.general:97391
X-Tomcat-NG: microsoft.public.windows.server.general

The server OS is Windows Server 2003 Standard Edition SP1, and the
clients
are Windows XP Professional SP2.

I guess this is going to turn into a request for the Windows development
team to correct the help file then - because it is certainly misleading
the
way it's put. The excerpt I provided in my original post is from the
actual
Windows help topics for Task Scheduler (in the help index it's listed
under
"security methods and issues", then "Task Scheduler"). The line "However,
a
member of the Administrators group can enable a member of any group to
create or modify scheduled tasks, by using the cacls command to modify
the
discretionary access control list (DACL) of the Tasks folder." seems to
indicate that there's a way around the Administrator-only restriction.

Of course there's a disclaimer at the top of the topic that "This content
might have been updated. For the most recent version, see the TechCenter
Web
site." But clicking that link is not context sensitive, and trying to
find
the exact information can be frustrating. I managed to get as far as the
topic "Schedule a task on a remote computer" on the page
http://technet2.microsoft.com/WindowsServer/f/?en/Library/6707dcc5-526b-4e
e0-bc8b-d8cde1fb71711033.mspx,
which told me that:

To perform this procedure, you must be a member of the Administrators
group, or have been delegated the appropriate authority, on the remote
computer. As a security best practice, consider using Run as to perform
this
procedure. For more information, see Default local groups , Default
groups ,
and Using Run as .
So I thought maybe I could be "delegated the appropriate authority". Is
this
an option? Unfortunately, it too was followed by another disclaimer:

Your server might function differently based on the version and edition
of
the operating system that is installed, your account permissions, and
your
menu settings. For more information, see Viewing Help on the Web .

So I guess no matter where I look, I get mixed answers. If you're telling
me
that without a doubt, there's no way around the requirement to put users
in
the Administrators group to access scheduled tasks, then it saves me a
lot
of trouble following link after link to dig up the answer.

Thanks for your time!

"Vincent Xu [MSFT]" <v-xuwen@xxxxxxxxxxxxxxxxxxxx> wrote in message
news:WA0J3ighGHA.464@xxxxxxxxxxxxxxxxxxxxxxxx
Hi,

What is the exact OS version?

This post is in microsoft.public.windows.server.general queue, so I
suspect
the OS is Windows server 2003. This is by design in Windows 2003,they
have
tightened the security in 2003. The OS won't let you schedule a job
with
a
standard user account.

Sorry for any inconvenience.


Best regards,

Vincent Xu
Microsoft Online Partner Support

======================================================
Get Secure! - www.microsoft.com/security
======================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others
may learn and benefit from this issue.
======================================================
This posting is provided "AS IS" with no warranties,and confers no
rights.
======================================================



--------------------
From: "Brian L." <699df88b-2059788708@xxxxxxxxxxxxxx>
Subject: Remote Task Scheduler access problem
Date: Thu, 1 Jun 2006 14:48:20 -0400
Lines: 43
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2869
X-RFC2646: Format=Flowed; Original
Message-ID: <OIZCNLbhGHA.4252@xxxxxxxxxxxxxxxxxxxx>
Newsgroups: microsoft.public.windows.server.general
NNTP-Posting-Host: 204-60-67-237.connecticare.com 204.60.67.237
Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP04.phx.gbl
Xref: TK2MSFTNGXA01.phx.gbl
microsoft.public.windows.server.general:97324
X-Tomcat-NG: microsoft.public.windows.server.general

Hello all,

I am trying to grant a few users access to see (as well as run and
stop)
scheduled tasks on one of our servers. I have been looking at the help
pages
for Task Scheduler, and I'm not having any luck. They are able to see
the
Scheduled Tasks folder, listed with the other shares on the system, if
they
navigate to it in the network (or start -> run -> \\server). However,
if
they double-click on the Scheduled Tasks folder it doesn't open. The
only
way around this has been to put the users into the local Administrators
group of the server. I'd like to avoid this if possible.

The answer seems to be in one section of the help page, but I haven't
been
able to get this to work:

By default, to schedule a task, you must be a member of the
Administrators,
Backup Operators, or Server Operators group on the local computer. By
default, when creating a scheduled task, you cannot enter a user who
belongs
to a group that has more rights than the group you belong to. For
example,
if you are a member of the Backup Operators group on the local
computer,
you
cannot specify a member of the Administrators group when creating a
scheduled task. However, a member of the Administrators group can
enable
a
member of any group to create or modify scheduled tasks, by using the
cacls
command to modify the discretionary access control list (DACL) of the
Tasks
folder. By default, the Tasks folder is located in the \Windows folder
on
the hard drive of the local computer, for example C:\Windows\Tasks. For
more
information about using cacls, see Cacls.


Now the above excerpt says that I can grant someone access, using
cacls,
to
the C:\Windows\Tasks folder on the server. So I created a group on the
domain, put one of the users into the group, used cacls to grant access
to
the C:\Windows\Tasks folder (at first Change, then I tried Full
Control),
then logged out and back in to make sure group membership took effect.
The
folder still behaved the same way - visible but I can't open it.

Does anyone know what I'm doing wrong? Or is the help file incorrect,
and
that method won't work? Any help is appreciated! Thanks.

-Brian










.

Relevant Pages

  • Scheduled task disabled on own
    ... I have a scheduled task on a Windows 2000 server that copies data from a UNIX ... server to the Windows server via FTP. ... Has anyone ever heard of a scheduled task just disabling on its own? ...
    (microsoft.public.win2000.general)
  • Re: My Server wants to shutdown forcefully
    ... What do you mean with the "the server was already locked"? ... Did you run the backup logged in with a user account or with a scheduled task without being logged in? ... I manage a Windows server ...
    (microsoft.public.windows.server.general)
  • Re: Task Scheduler in Windows Server 2008
    ... I am trying to translate that into a Scheduled Task ... using the Task Scheduler in Windows Server 2008. ...
    (microsoft.public.win2000.general)
  • automatic shutdown
    ... I have windows server 2003 installed in my lab. ... Scheduled task did not work if no user is logged on the server. ...
    (microsoft.public.windows.server.sbs)
  • Re: scheduled task can not access shared drive
    ... the user/ group 'logon as batch job' rights. ... I log onto server A and run the batch file it works; ... And it runs fine in as a scheduled task as ... You can see that the status of all the mapped drives are ...
    (microsoft.public.win2000.general)