Create Scheduled Task in GPOPref using System account - issue

Hi all,
I'm trying to create a scheduled task (computer configuration) in GPOPref which is executed by the system account. Creating locally and running the task manually is running without issues.
When I'm creating the task in a GPOPref using a domain account the task is installed on the targetsystem. When just changeing the account to System and run gpupdate the task is not deployed.
Any hints or workaround? Thanks for you help in advance.
Regards,
Andreas

> When I'm creating the task in a GPOPref using a domain account the task
> is installed on the targetsystem. When just changeing the account to
> System and run gpupdate the task is not deployed.
Please post the XML of your task in the state that is not working (right
click - all tasks - display xml).
And as a hint: There's a german GP forum too -
https://social.technet.microsoft.com/Forums/de-DE/home?forum=gruppenrichtliniende
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Similar Messages

Run Powershell script from Scheduled Task as "NT Authority \ SYSTEM"

Hello, dear Colleagues.
Cannot make Powershell script from Scheduled Task as "NT Authority \ System"
Action: Start a program -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "C:\script.ps1"
The matter is that script is working, moreover if to run Task with Domain Account it works too.
Checked Run with highest privileges, changed "Configure for" field, tried different arguments (-noprofile, -noexit, -executionpolicy bypass, -command, -file,") - no luck.
Didn't you try to make it work with SYSTEM account?
Thanks.

Hi fapq,
Try this link task schedulers
Note
To identify tasks that run with system permissions, use a verbose query (/query/v). In a verbose query display of a system-run task, the Run As User field has a value of NT AUTHORITY\SYSTEM and
the Logon Mode field has a value of Background only.
Naveen Basati

Creating scheduled task to run powershell script

Hi all,
been following this guide on how to create scheduled task to run a .ps1 script:
http://blogs.technet.com/b/heyscriptingguy/archive/2012/08/11/weekend-scripter-use-the-windows-task-scheduler-to-run-a-windows-powershell-script.aspx
When I manually run this task,in the history it says success, but it doesnt work.
The script should create a report and send me an e-mail.It works fine if i run it manually in Windows powershell or Powershell ISE.
I cannot see that a new report have been created either.
Anything im missing here?
Been using same account to run it manually and the one using in task scheduler.
thanks!
Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you. Thank you! Off2work

Hi all,
been following this guide on how to create scheduled task to run a .ps1 script:
http://blogs.technet.com/b/heyscriptingguy/archive/2012/08/11/weekend-scripter-use-the-windows-task-scheduler-to-run-a-windows-powershell-script.aspx
When I manually run this task,in the history it says success, but it doesnt work.
Try executing the same command in cmd line, do you get a different result? or does that work as well?

Issues with Backup-GPO Scheduled Task as a non-admin account

I'm having an issue trying to get a daily backup of domain GPO's from a non-administrative account. I'm using Powershell 2.0, the Backup-GPO cmdlet runs fine as a standard user, but when I run the same cmdlet with the same user, but with a scheduled task,
the backup does not produce valid output. The command I run is:
[batch file called by scheduled task]
powershell.exe d:\loj\psps.ps1
[psps.ps1]
import-module grouppolicy
backup-gpo -all -path d:\loj
The specific problem is, all other files created by the backup are created successfully except the 'gpreport.xml' file found directly under the folder identified by the backup ID. All of the subdirectories under DomainSysvol\GPO contain xml files with the
appropriate data, and the Backup.xml and bkupInfo.xml files are also created normally. The manifest.xml file is also created normally in the root directory.
The gpreport.xml file however is malformed. It contains only two bytes of data, FF FE.
The reason this is a problem is that the xml in the gpreport file can be used to restore whether the GPO is 'enforced' and also contains link data. Using this when restoring the GPO's makes the process a lot less painful.
Running the batch file while logged in interactively as the user removes the problem, without making them an administrator.
I've been using a test domain to investigate this, I tried adding the user in question to every local group except administrators, gave it full control to the destination folder for backups, the powershell executable, batch and ps1 files. Resultant set of
policy access has been granted (rsop.msc run-as the user tested fine). The scheduled task stores credentials (needs to run when the user is not already logged in) and runs with the highest privileges.
The only possibly related error I could find in the logs was this:
This error goes away if enough group memberships are added to the account or alternatively if this string is added to the security descriptor for the LanManServer service: (A;;GA;;;S-1-5-21-1191697313-1384311512-914143962-35706), which just adds
generic all to this account by referencing the SID. However, despite the fact that the error is no longer raised, the issue with the gpreport.xml file remains.
Does anyone have any ideas on why this is happening? At this point my best guess is something UAC related, since the gpreport.xml file is created like normal if the user is made an administrator on the local machine (I'd rather not do that in production).

Hi Fergubru,
Thanks for your posting.
To troubleshoot Task scheduled that a task ran, but the program that should have been executed did not run correctly.
As AZ said above, some programs require elevated privileges to run correctly. If a task is running a program that requires elevated privileges, ensure that the task runs with the highest privileges. You can set a task to run with the highest privileges
by changing the task's security options on the General tab of the Task Properties dialog box.
If a task program does not run correctly, check the history of the task for errors. For more information, see
View Task Properties and History.
For the Event ID 4656, this is an Audit log, This event will be Audit Success or Audit Failure depending on whether the user account under which the account is running has the requested permissions or not.
For more detailed information about Event ID 4656, please refer to this article:
http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4656
I hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Cannot create scheduled task, access denied

Windows Server 2003 R2
I am logged in as a local administrator and cannot create a scheduled task:
[Task Scheduler]
The new task could not be created.
The specific error is:
0x80070005: Access is denied.
Try using the Task page Browse button to locate the application.
[OK]
My research lead me to look look in the Group Policy Object Editor for:
Windows Settings > Security Settings > File System > %SystemRoot%\Tasks
On this machine, there is no "File System" folder. In the MSDN Library, I find:
"The File System folder is available only in Group Policy objects associated with domains, OUs, and sites. The File System folder does not appear in the Local Computer Policy object."
Any ideas?

found this information, problem solved...
Problem Description:
===================
When trying to create a new scheduled task, error occurred "The new task could not be created." "0x80070005: Access is denied. Try using the Task page Browse button to locate the application."
Cause:
===================
The Administrators group lack permission on the C:\WINDOWS\Tasks folder.
Resolution:
===================
Start - Run - CMD - C:/windows - CACLS TASKS /E /G builtin\administrators:F
The steps above grant Administrators group full control permission to the C:\WINDOWS\Tasks folder.
Again, thank you for posting in the SBS newsgroups. Please feel free to contact us again in the future.
Best regards,
Robbin Meng(MSFT)
Microsoft Online Newsgroup Support

Can't install Java silently on Win7 64 using system account

Hi,
I'm trying to distribute jre-6u31-windows-i586-s.exe which is 32 bit to Windows 7 64 bit PCs using SCCM. This uses the system account, it works fine on 32 bit Win 7 Pc's but the silent install fails on 64 bit. In the past we've been able to extract the msi, there's been no problem with that, but Oracle don't seem to offer this package as an msi anymore, a big disadvantage for us. I've seen several posts on the web regarding this but no solution?
Is anyone able to help?
Many thanks,
Stephen

Hello, we are experiencing the same problem here. I am trying to install the 32-bit version of java 6u31 (jre-6u31-windows-i586-s.exe) via an SCCM task sequence with the /s switch. This runs the installer as the SYSTEM account and whilst it seems to install the 64-bit version fine it fails to install the 32-bit version. I have gone so far as to follow this guide on launching a command prompt as SYSTEM
http://social.technet.microsoft.com/Forums/en-US/w7itprogeneral/thread/64bbf341-260a-4778-8aa8-ff53f3659101/
then launching the jre-6u31-windows-i586-s.exe without any switches. This allows me to see the installer within the SYSTEM shell and I can see the following error after clicking "Install" at the welcome to java screen.
*"Windows Installer"*
*"The installation package could not be opened, verify that the package exists and you can access it or contact the application vendor to verify that it is a valid Windows Installer package"*
I can only suspect that the installer must extract the msi file to some arbitrary location that the SYSTEM account can't see. I have tried using Universal Extractor to get hold of an MSI file to install this version of java but this so far hasn't been successful.
If this isn't fixed soon I will be forced to try and use an older version of the JRE. Can anyone from oracle direct us to where we can get hold of an MSI file or how to work around this issue?_
Thank you
d4rkcell.com
PS - It appears to install without error when ran from an administrative user account. Obviously this is no good as we are deploying to 700+ machines and really need it to work from SCCM. I am going to try and use the runas command in windows to see if this will work but I am not holding my breath.
PPS - Runas is no good, as it requires password input and even then it doesn't seem to work very well from the SYSTEM conext.
Edited by: 921104 on 15-Mar-2012 05:14
Edited by: 921104 on 15-Mar-2012 05:16
Edited by: 921104 on 15-Mar-2012 05:19

How to create scheduled task to delete failure/open tasks

hi.
I have a question that I hope someone can give me some input to.
we have an OIM 9.1.0.1 installation and have a situation where we have around 14 500 open tasks. we read somewhere that this might cause performance issues. we have also found a HOWTO on Oracle Metalink that explains how to delete these tasks. i states that one should:
- Create a scheduled task which uses the API:
Thor.API.Operations.tcProvisioningOperationsIntf.setTasksCompletedManually
...and that's it. it doesn say anything else. doing this by creating a scheduled task in OIM Admin Console will not work since we don't have this Java class. is there anyone who has sort a similar problem? any help/tips/guidelines are appreciated.
P.S.: The Oracle Metalink HOWTO:
Link: [https://metalink.oracle.com/CSP/ui/flash.html#tab=KBHome(page=KBHome&id=()),(page=KBNavigator&id=(from=BOOKMARK&bmDocType=HOWTO&bmDocDsrc=KB&bmDocTitle=How%20to%20%3Cb%3EDelete%3C/b%3E%20Failure%20or%20Cancelled%20%3Cb%3ETasks%3C/b%3E%20in%20%3Cb%3EOpen%3C/b%3E%20%3Cb%3ETasks%3C/b%3E&bmDocID=731282.1&viewingMode=1143))]
Edited by: user10378227 on Oct 27, 2009 1:07 AM

Use this link:
How to create a new schedule task from java code
http://download.oracle.com/docs/cd/E10391_01/doc.910/e10361/tasks_archival.htm#sthref85

Not able to create Schedule Task in OIM 9.1.0.2

Hi,
I created one Java program and created Jar file. Then placed in Schduled Task folder.
When I try to create one Schedule Task in OIM web console, I am not able to see the Class File name in the list.
Please let me know what could be the reason for this.
Thansk for your help.

In OIm Web console, there is one serach where we can serach the required class file. I am not able to see the class file in the list where as I am able to see other class files for other scheduled Tasks.
But I am not able to see my Class file.
When I try to paste the full class file path in Design Console, It gives an error saying No database read.
This is very urgent for me to create the scheduled Task.
Any idea??

How to set schedule task in windows using java code

Hi,
i want to set the schedule task in windows os using the java code can any one help me on that
can any one thinks i need to wright a dll file for that which set the schedule task for me which dll i can use in my java code.
thanks in advance.

Maybe this will help you?

Create DSN in admin tool using domain account

Hi. We're moving away from SQL authentication and using
domain accounts for SQL Server authentication. How does one create
a data source in the admin site to use a domain account? Is this
possible? We're using ColdFusion 6.1. Thanks.

We've tried that and get the following error,
Connection verification failed for data source: myDataSource
[]java.sql.SQLException: [Macromedia][SQLServer JDBC
Driver][SQLServer]Login failed for user 'MYDOMAIN\domainAccount'.
The root cause was that: java.sql.SQLException:
[Macromedia][SQLServer JDBC Driver][SQLServer]Login failed for user
'MYDOMAIN\domainAccount'.
The account exists on the SQL Server 2005 database and has
read/write privileges.

JDK 1.6+ 32bit version on Vista 64 - SYSTEM account issue

Hello,
I am just fishing for experience here with installing the Java JDK 1.6 (32 bit version) on Vista64 using the SYSTEM account. My test case that I am using is I can download any of the 1.6 JDK exe versions then create a simple task to run as SYSTEM that will execute the exe with the /passive (tried /qn as well) option this fails with "return code 1619" which is something about package can not be opened. However when the task is changed to run with an admin account this task completes return code 0 and the the JDK is installed.
The root problem here is we are attempting to install apps that require the 32 bit version of the JDK to be present to install where everything is being installed through SMS using the SYSTEM account.
Any insight anyone might have on this would awesome

Zia wrote:
but my OS is 64 bit as "uname -a" command shows.No ...
i686 i686 i386... these are part of the x86 family, which is 32-bit.

Error when creating Task List: No Consolidation System found

All-
Configuring my Retrofit Scenario. My Project Landscape is maintained as following:
Dev(100) --> QA (200) --> Prod (300) with Retrofit (XXX)
Dev(XXX) --> QA 250
I am getting this error when I try to refresh the project or create a Task List
*No consolidation system found for <SID>-250 (project RETROFIT3)
Message no. /TMWFLOW/TRACK_N806*
If my QA client (250) is already maintained as a QA logical component. What else is missing?

Hi,
I have done something similar and getting error /TMWFLOW/TRACK_N806
My Transport route looks something like
System GND ZGND > 300 System GNQ 300> 300 System GNP
Its a standard 3 system landscape with transport routes configured as mentioned above. I followed the write up as mentioned and have kept only one transport route but how do i create a transport route from GND-140 to GNQ-300 .
The layer ZGND has been associated with client 140 which is the development client here. The layer ZGND is the consolidation layer, how else should i associate it with the client 140.
Please advice.
Regards
Ankan

KM Scheduler Task Cache issue

We have created couple of custom schedulers in Enterprise Portal. These schedulers are worked fine in our QA and DEV environment. But when we move the same transport to Production the scheduleru2019s tasks are not showing up in KM scheduler list. But after restarting J2EE couple of times it's showing up in KM scheduler task. This is the behavior we are seeing whenever we move the scheduler to production.
Here are the some technical details about the scheduler,
We have created one Portal Development component and 10 Scheduler Tasks under this component. All the tasks are not created in a single release. Initially when we develop we used to have 2 scheduler tasks under this component, when we move this transport to production we didn't faced any issue. Even after adding 4 to 5 scheduler task we didn't had any issues. After adding more than 6 to 7 whenever we add one we are getting the same issue.
Question: 1 - Is there any limit to for adding Scheduler task in one Portal Component?
This time we have restarted our server more than 5 times but scheduler not showed up. We ask our manger to logon to the portal server who never navigated to KM screen, we ask her to navigate and she did. For her schedulers are showed up. After she navigated to the KM screen everybody is able to see the scheduler. This is not the first time it happens like this, the same situation happen for the previous release also. In previous release we ask our Technical Architect to login to see KM schedulers. After his login everybody is able to see the schedulers.
After doing all these is what I obverse is, it seems KM scheduler has some server level cache for the user and it's giving old screen whenever we are trying to login and see. After the transport, the cache is not getting updated with the new version.
We guess it might be something we need to do with cache.
Is there any idea why the system is behaving like this.

Hi,
I am facing similar issue. How did you resolve it?
Regards,
Apurva

SharePoint Designer Workflow unnecessary set Modified By value as System Account.

Hi Friends,
I have created SharePoint Designer Workflow, it update other List Item as well same Item on Item Adding and Editing event.
I have Developed workflow using System Account.
While doing any change by general user in Workflow list it update Modified By value to System Account only.
I want modified by value as General user only.
Or No need to update modified and Modified by details.
So please help me How I can resolve this issue.
Thanks,
Digambar Kashid
Thanks and Regards, Digambar Kashid

Hi Digambar, that's by design, but here are some workarounds:
http://blog.mmasood.com/2012/12/approval-worfklow-showing-system.html
https://social.technet.microsoft.com/Forums/office/en-US/f3f9b1ff-9507-4471-935d-4ab8937839b6/oob-approval-workflow-makes-modify-by-field-as-system-account?forum=sharepointadminprevious
cameron rautmann

Schedule Task - Windows 2008 R2 - User Session

I am migratiing the schedule task from windows 2003 to windows 2008 and find some of behaviour change on handling user session by Task Scheduler.
I have a simple batch to call "net use" command to map a network drive for copying file to remote server. And I have scheduled 3 similar tasks and run as same user (e.g. testuser)
In windows 2003 enviornment, the mapped network drive resource will not be accessed by another schedule task. In windows 2008 R2, howerver, the network drive mapped in one of schedule task can be reached by another task. Does anyone have
idea on this behaviour change?
Here are the testing script
Test Script 1
NET USE >> D:\TEST1.LOG
NET USE Z: \\127.0.0.1\Share /PERSISTENT:NO >> D:\TEST1.LOG
ping 127.0.0.1 -n 100
NET USE Z: /DELETE
Test Script 2
NET USE >> D:\TEST2.LOG
NET USE Z: \\127.0.0.1\Share /PERSISTENT:NO >> D:\TEST1.LOG
ping 127.0.0.1 -n 100
NET USE Z: /DELETE
Test Script 3
NET USE >> D:\TEST3.LOG
NET USE Z: \\127.0.0.1\Share /PERSISTENT:NO >> D:\TEST3.LOG
ping 127.0.0.1 -n 100
NET USE Z: /DELETE
Output in Windows 2003
Test1.LOG
New connections will not be remembered.
There are no entries in the list.
The command completed successfully.
z: was deleted successfully.
Test2.LOG
New connections will not be remembered.
There are no entries in the list.
The command completed successfully.
z: was deleted successfully.
Test3.LOG
New connections will not be remembered.
There are no entries in the list.
The command completed successfully.
z: was deleted successfully.
Output in Windows 2008
Test1.LOG
New connections will not be remembered.
There are no entries in the list.
The command completed successfully.
z: was deleted successfully.
Test2.LOG
New connections will not be remembered.
Status       Local     Remote                    Network
OK           Z:
\\127.0.0.1\Share          Microsoft Windows Network
The command completed successfully.
System error 85 has occurred.
The local device name is already in use.
The network connection could not be found.
More help is available by typing NET HELPMSG 2250.
Test3.LOG
New connections will not be remembered.
Status       Local     Remote                    Network
OK           Z:
\\127.0.0.1\Share          Microsoft Windows Network
The command completed successfully.
System error 85 has occurred.
The local device name is already in use.
The network connection could not be found.
More help is available by typing NET HELPMSG 2250.

Sorry for confusing, I have udpated the script for this testing
=====================================================
Script for Schedule Task 1 - to map a network drive and issue a ping command to "sleep"
Echo %date% %time% list drive on schedule task 1
NET USE
Echo %date% %time% map drive on schedule task 1
NET USE Z: \\127.0.0.1\Share /PERSISTENT:NO
ping 127.0.0.1 -n 100 > NUL
Echo %date% %time% remove drive on schedule task 1
NET USE Z: /DELETE
Script for Schedule Task 2 - to list out any network drive are mapped.
Echo %date% %time% list drive on schedule task 2
NET USE
========================================================================
The schedule task 2 are triggered while the schedule task 1 are running, In the windows 2003, the schedule task 2 could not list out any mapped drive. In the windows 2008, however, the schedule task 2
can list the network drive mapped by schedule task 1. The question is if there are any changes between windows 2003 and 2008, hope it can clarify.
Ouput on windows 2003
Schedule task1
D:\>Echo Wed 02/06/2013 18:31:52.93 list drive on schedule task 1
Wed 02/06/2013 18:31:52.93 list drive on schedule task 1
D:\>NET USE
New connections will not be remembered.
There are no entries in the list.
D:\>Echo Wed 02/06/2013 18:31:52.98 map drive on schedule task 1
Wed 02/06/2013 18:31:52.98 map drive on schedule task 1
D:\>NET USE Z: \\127.0.0.1\Share /PERSISTENT:NO
The command completed successfully.
D:\>ping 127.0.0.1 -n 100 1>NUL
D:\>Echo Wed 02/06/2013 18:33:32.07 remove drive on schedule task 1
Wed 02/06/2013 18:33:32.07 remove drive on schedule task 1
D:\>NET USE Z: /DELETE
Z: was deleted successfully.
Schedule Task 2
d:\>Echo Wed 02/06/2013 18:32:22.54 list drive on schedule task 2
Wed 02/06/2013 18:32:22.54 list drive on schedule task 2
d:\>NET USE
New connections will not be remembered.
There are no entries in the list.
Output on windows 2008
Schedule task1
C:\Windows\system32>Echo Wed 02/06/2013 18:17:52.13 list drive on schedule task 1
Wed 02/06/2013 18:17:52.13 list drive on schedule task 1
C:\Windows\system32>NET USE
New connections will not be remembered.
There are no entries in the list.
C:\Windows\system32>Echo Wed 02/06/2013 18:17:52.16 map drive on schedule task 1
Wed 02/06/2013 18:17:52.16 map drive on schedule task 1
C:\Windows\system32>NET USE Z: \\127.0.0.1\Share /PERSISTENT:NO
The command completed successfully.
C:\Windows\system32>ping 127.0.0.1 -n 100
1>NUL
C:\Windows\system32>Echo Wed 02/06/2013 18:19:32.59 remove drive on schedule task 1
Wed 02/06/2013 18:19:32.59 remove drive on schedule task 1
C:\Windows\system32>NET USE Z: /DELETE
Z: was deleted successfully.
Schedule task2
C:\Windows\system32>Echo Wed 02/06/2013 18:18:07.69 list drive on schedule task 2
Wed 02/06/2013 18:18:07.69 list drive on schedule task 2
C:\Windows\system32>NET USE
New connections will not be remembered.
Status       Local     Remote                    Network
OK           Z:        \\127.0.0.1\Share
Microsoft Windows Network
The command completed successfully.

Create Scheduled Task in GPOPref using System account - issue

Similar Messages

Maybe you are looking for