Issues with Backup-GPO Scheduled Task as a non-admin account

Question

I'm having an issue trying to get a daily backup of domain GPO's from a non-administrative account. I'm using Powershell 2.0, the Backup-GPO cmdlet runs fine as a standard user, but when I run the same cmdlet with the same user, but with a scheduled task,
the backup does not produce valid output. The command I run is:
[batch file called by scheduled task]
powershell.exe d:\loj\psps.ps1
[psps.ps1]
import-module grouppolicy
backup-gpo -all -path d:\loj
The specific problem is, all other files created by the backup are created successfully except the 'gpreport.xml' file found directly under the folder identified by the backup ID. All of the subdirectories under DomainSysvol\GPO contain xml files with the
appropriate data, and the Backup.xml and bkupInfo.xml files are also created normally. The manifest.xml file is also created normally in the root directory.
The gpreport.xml file however is malformed. It contains only two bytes of data, FF FE.
The reason this is a problem is that the xml in the gpreport file can be used to restore whether the GPO is 'enforced' and also contains link data. Using this when restoring the GPO's makes the process a lot less painful.
Running the batch file while logged in interactively as the user removes the problem, without making them an administrator.
I've been using a test domain to investigate this, I tried adding the user in question to every local group except administrators, gave it full control to the destination folder for backups, the powershell executable, batch and ps1 files. Resultant set of
policy access has been granted (rsop.msc run-as the user tested fine). The scheduled task stores credentials (needs to run when the user is not already logged in) and runs with the highest privileges.
The only possibly related error I could find in the logs was this:
This error goes away if enough group memberships are added to the account or alternatively if this string is added to the security descriptor for the LanManServer service: (A;;GA;;;S-1-5-21-1191697313-1384311512-914143962-35706), which just adds
generic all to this account by referencing the SID. However, despite the fact that the error is no longer raised, the issue with the gpreport.xml file remains.
Does anyone have any ideas on why this is happening? At this point my best guess is something UAC related, since the gpreport.xml file is created like normal if the user is made an administrator on the local machine (I'd rather not do that in production).

Answer 1

Hi Fergubru,
Thanks for your posting.
To troubleshoot Task scheduled that a task ran, but the program that should have been executed did not run correctly.
As AZ said above, some programs require elevated privileges to run correctly.  If a task is running a program that requires elevated privileges, ensure that the task runs with the highest privileges. You can set a task to run with the highest privileges
by changing the task's security options on the General tab of the Task Properties dialog box.
If a task program does not run correctly, check the history of the task for errors. For more information, see
View Task Properties and History.
For the Event ID 4656, this is an Audit log, This event will be Audit Success or Audit Failure depending on whether the user account under which the account is running has the requested permissions or not. 
For more detailed information about Event ID 4656, please refer to this article:
http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4656
I hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.