Re: Running Scheduled Tasks Remotely Without Full Administrator Ri

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance


"Matt Callaghan" <MattCallaghan@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:A098A7B4-DAC2-4461-9205-CDDC90B73437@xxxxxxxxxxxxxxxx
Hi Herb,
Thanks for continuing to reply;

I think this is the problem, windows by default requires administrator
rights to be able to remotely schedule tasks to be run on a server.

What I'm trying to determine is if there is a group policy object
somewhere
that we can set which would allow a certain set of users (i.e. members of
group "Task Schedulers" for example) to schedule tasks to be run as
"System"
without being an administrator.


PS: I still don't understand what you mean by : "Run as Batch". Could
you
please give a specific example as to how I can allow a user this
privilege?

Run as Batch is a RIGHT, like Logon Locally, or Change System Time.

You can set this in the Local settings of Computer Management or for many
computers/users through a Group Policy in the Computer->Security settings.

There is some right that is sufficient for setting the Task to run remotely,
there
has to be because that is how Admins do it. Whether this is a "single"
right
or a bunch of them that would practically make the remote person an admin
I do not know, but if you haven't given the users "Run as Batch" yet then
you have NOT really tested it.


--
Herb Martin, MCSE, MVP
http://www.LearnQuick.Com
(phone on web site)

"Herb Martin" wrote:


"Matt Callaghan" <MattCallaghan@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in
message
news:486DC4FD-6027-420D-A50B-CFA0D1413C8E@xxxxxxxxxxxxxxxx
Adding the user to the "Log on as Batch" group policy does not allow
them
to
schedule tasks still....

Run as Batch. There is no Logon as Batch unless you created that.

What else can we try?

See if they can schedule a batch locally. The remote scheduler may
require
admin (like) privileges.


--
Herb Martin, MCSE, MVP
http://www.LearnQuick.Com
(phone on web site)

"Herb Martin" wrote:


"Matt Callaghan" <MattCallaghan@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in
message
news:1BACB24D-07CD-4DCC-A137-DCDBC57E3326@xxxxxxxxxxxxxxxx
One thing to note however is that users are REMOTELY scheduling
tasks
(over
the network).

Where is "Run as Batch"?
... I don't see it as a group.

It is not -- it is a Right. But you might create such a Group, give
the
right, and make it easy to give the right by adding someone to the
group (if you don't already have users in a large number of groups.)

Check RIGHTS not groups.

--
Herb Martin, MCSE, MVP
http://www.LearnQuick.Com
(phone on web site)


"Herb Martin" wrote:


"Matt Callaghan" <MattCallaghan@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in
message
news:82FE86B2-BBBE-40C8-9D8B-1BD3C2822FDB@xxxxxxxxxxxxxxxx
I'm also trying to do this...

It seems that in order to CREATE a task, one must be an
administrator.
I also cannot find any way to allow a user to CREATE a task
without
being
an
administrator.

What if you give the user "Run as Batch" right explicitly?

This should work to Schedule and RUN the task locally (in the Task
Scheduler)
but the user may need more privilege depending on what the task
actually
does.

See this post for details:
http://www.tek-tips.com/viewthread.cfm?qid=1367286&page=1

"Dragos CAMARA" wrote:

hi,
try to create the scheduled task with the test user.
--
Dragos CAMARA
MCSA Windows 2003 server


"Ryan" wrote:

I'm trying to setup a user to be able to run a scheduled task
on
a
remote
server using the following command:

schtasks /run /s MyServer /TN MyTask

Of course, this works fine if I make the user a local
administrator
on
the
server hosting the scheduled task. But...I don't want this
user
to
have full
administrator rights on the server.

I gave the user read/execute permissions on the security tab
for
the
task
itself. I've also given the user "Log on as a batch job"
permissions
in the
local security policy, but I am still getting an "ERROR:
Access
is
denied."
message.

As a work around I also tried giving a test user RDP access to
the
server to
see if that would do the trick, but I get an "Access is
denied"
message
when
I click on the Scheduled Tasks icon in the control panel.

Anyone have any ideas on this one?











.

Relevant Pages

  • Re: rebooting OK when locked out of computer?
    ... have remote access. ... I'm locked out of my server. ... >> which were administrator accounts, for the old IT guy, ... >> administrative password works to access folders on the ...
    (microsoft.public.win2000.security)
  • Re: Remote Server Administration (repost)
    ... regards to access rights, wouldn't Administrator account ... >Remote desktop users ... >Check Allow logon to terminal server ... (even if I log in as Administrator). ...
    (microsoft.public.windows.server.sbs)
  • Re: Remote access to SBS2003
    ... You mean for remotely administering the server, ... if you log onto RWW as an Administrator - you will have access to server ... > desktop to the server I suppose using the remote server management icon on ... So how do I create a secure connection from ...
    (microsoft.public.windows.server.sbs)
  • Windows 2003 remote desktop non-admin users
    ... We have Windows 2003 server with Terminal Services installed in Remote ... to give away Administrator rights just to start the application. ...
    (microsoft.public.windows.terminal_services)
  • Re: HKEY_LOCAL_MACHINE Registry Access
    ... > administrator on the W2K3 box and authenticate as the local administrator ... I connect to the remote registry with no problems. ... > application specific for Exchange Server 2003. ...
    (microsoft.public.dotnet.languages.csharp)