Scheduled Tasks - Administrator Best Practices

Hi all,
I've gotten assistance this week with a couple scripts and scheduling them as tasks. I actually have well over a dozen running on our Exchange server using a special user with a complex password. This user is not used for logging into any machine, but it
is a member of 'Administrators' group and can be used for tasks requiring elevated privileges.
What I am interested in learning is what the best practice is for running scheduled tasks. We have several, such as querying AD for members of select OUs or users who meet certain criteria. We also have automated emails regarding certain mailbox metrics,
etc. You get the idea.
Despite the complex credentials, this account is still discoverable and could be used in nefarious ways. Is it possible be running tasks on Server 2008 R2 (2012 possibly) without administrator credentials? Are there certain restrictions for the tasks (like
is a scheduled reboot allowed by a standard account, but not querying Active Directory?).
I also have noticed a checkbox with 'Run with highest privileges' and do not fully understand what this means.
When I try to run the task as a regular user (no remote permissions) and it says 'Logon failure: the user has not been granted the requested logon type as this computer.'
In short, can I safely remove our special user account from 'Administrators' and place into regular users without breaking all of our tasks?

Hi KSI-IT,
Firstly, based on my research, if you want to run the task scheduler with a user account, the user account must have the corresponding permission, in other words, you can also manually run the script with the user account.
1. For the error you posted 'Logon failure: the user has not been granted the requested logon type as this computer', please make sure the task account has "logon as a batch job" privilege.
To add the privilege of the account, please go to
[Local Security policy\Local Policies\User Rights Assignment]
-Log on as a batch job.
Add the domain\username account and any others you may need and retry.
2. For the setting 'Run with highest privileges', this means that it runs with the highest privileges available to that user. This is different from the context menu's 'Run As Admin'.
It generates the highest privilege token for the specific user, however, it cannot run as a different user, for a standard user with no elevated permissions, 'Run with highest privileges' does not do anything.
Reference from:
What
effect does "run with highest priviledges" in task scheduler have on powershell scripts?
I hope this helps.

Similar Messages

When to use unattend.xml in task sequence - best practice?

Hi, I've tried researching this but not found an answer to my specific query.
We have ConfigMgr 2012 R2 with MDT 2013 although I don't think this is an MDT specific question.
I'm trying to create a Build and Capture task sequence for our Windows Server 2008 R2 and Server 2012 /2012R2 server builds utilising an UNATTEND.XML file to make some customisations that can be deployed for every build afterwards in a Deployment Task Sequence.
Specifically the addition of some Windows Features like SNMP and it's configuration and the addition of the Telnet Client. There are other bits like language settings and configuration items but I'm specifically interested in the Features part for my question.
In CM 2012R2 you now have the option under the "Apply Operating System" to use a captured image or an original installation source. However they work differently if you specify the use of the same unattended answer file.
The "image" deployment ignores all of the "add features" sections of the XML file and the "installation source" loses the configuration options from SNMP from the XML file. When you then deploy the captured image using
the same unattend.xml again the one from the "installer" now has all the SNMP features required and the one from the "image" is still missing everything.
So my question is as follows.
What is best practice for specifying an unattend.xml file in a task sequence. Is it in the build and capture TS or in the Deployment TS ?
or
Do I need multiple XML files, one for build and capture with some bits in and another for deployment with the rest in?
or
Should I be doing something else?
Although this is specifically asking about Server O/S we will be using the same methodology for Windows 7 deployment.

In this case DISM is only used to add the actual features... for configuration you could use a simple script that runs afterwards. Sample registry file:
SAMPLE REG FILE - HKLM-SNMP.reg
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SNMP\Parameters]
"NameResolutionRetries"=dword:00000010
"EnableAuthenticationTraps"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SNMP\Parameters\PermittedManagers]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SNMP\Parameters\RFC1156Agent]
"sysServices"=dword:0000004f
"sysLocation"=""
"sysContact"=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SNMP\Parameters\TrapConfiguration]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SNMP\Parameters\TrapConfiguration\public]
"1"="127.0.0.1"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SNMP\Parameters\ValidCommunities]
"public"=dword:00000004
Sample batch file:
SAMPLE SCRIPT FILE - ConfigureSNMPService.bat
@ECHO OFF
net stop "SNMP Service"
regedit /s HKLM-SNMP.reg
net start "SNMP Service"
Also some settings for SNMP can be controlled through group policy:
http://serverfault.com/questions/285762/group-policy-for-multiple-snmp-permitted-managers

Authorizations for tasks (R_UC_TASK) / Best Practice SEM-BCS authorization

Dear Experts,
I am quite new to authorizations and in particular to SEM-BCS authorization. So I would be happy if you could help me with the following requirement:
We have to setup an authorization concepts for SEM-BCS. Among others we want to setup authorizations for consolidations tasks using authorization object R_UC_TASK. With this authorization object certain tasks can be restricted to certain characteristic values u2013 e.g. for a certain consolidation group or a certain consolidation unit. We have defined a role each for certain consolidation tasks. These roles are not restricted to any characteristic value yet. We have for instance a role u201Cregional controlleru201D who is allowed to perform certain BCS tasks on a regional level (consolidation unit level). This would mean that we would have to create the role u201Cregional controlleru201D for all consolidation units u2013 see example below:
Role 1: Regional Controller u2013 Cons. Unit 1000
Role 2: Regional Controller u2013 Cons. Unit 1100
Role 3: Regional Controller u2013 Cons. Unit 1200
Role n: Regional Controller u2013 Cons. Unit n
We have more than 400 consolidation units. So this would require a high effort. Is there instead a possibility of creating one role based on authorization object R_UC_TASK which just defines which activities can be performed (without restricting access to a certain consolidation unit). , and using second role which defines the consolidation unit access? u2013 see example below:
A
Role: Regional Controller
Role: Cons Unit 1000
B
Role: Regional Controller
Role: Cons Unit 1100
C
Role: Regional Controller
Role: Cons Unit 1200
In this case we only would have to maintain one role u201CRegional Controlleru201D and we only would have to assign the restriction for the consolidation unit. How could this be realized? Or do you have any other ideas to solve this requirement in a simple way?
Moreover I would be happy if you could tell me where I could find best practice scenarios for SEM-BCS authorizations.
Thanks a lot in advance!
Best regards
Marco

Hello Marco,
you can enter a master role in the description tab of a role. All fields populated via program PFCG_ORGFIELD_CREATE can be maintained in the role. All other fields will be taken from the master role. So you only need to populate the field for unit with the program.
Good luck
Harry

Cisco Administration Best Practice - TACACS+ or RADIUS

I'm new to cisco and currently building a midsize environment and wanted to know what is the best practices for administration management of cisco equipment?
Thanks!

Using TACACS+ with ACS especially gives you all of the AAA's - this is better/best practice for mgmt access to Cisco devices imho.
Bilal

Database Administration - Best Practices

Hello Gurus,
I would like to know various best practices for managing and administering Oracle databases. To give you all an example what I am thinking about - for example, if you join a new company and would like to see if all the database conform to some kind of standard/best practices, what would you look for - for instance - are the control files multiplexed, are there more than one member for each redo log group, is the temp tablespace using TEMPFILE or otherwise...something of that nature.
Do you guys have some thing in place which you use on a regular basis. If yes, I would like to get your thoughts and insights on this.
Appreciate your time and help with this.
Thanks
SS

I have a template that I use to gather preliminary information so that I can at least get a glimar of what is going on. I have posted the text below...it looks better as a spreedsheet.
System Name
System Description
     Name      Phone     Pager
System Administrator
Security Administrator
Backup Administrator
Below This Line Filled Out for Each Server in The System
Server Name
Description (Application, Database, Infrastructure,..)
ORACLE version/patch level          CSI
          Next Pwd Exp
Server Login
Application Schema Owner
SYS
SYSTEM
     Location
ORACLE_HOME
ORACLE_BASE
Oracle User Home
Oracle SQL scripts
Oracle RMAN/backup scripts
Oracle BIN scripts
Oracle backup logs
Oracle audit logs
Oracle backup storage
Control File 1
Control File 2
Control File 3
Archive Log Destination 1
Archive Log Destination 2
Datafiles Base Directory
Backup Type     Day     Time     Est. Time to Comp.     Approx. Size
archive log
full backup
incremental backup
As for "Best" practices, well I think that you know the basics from your posting but a lot of it will also depend on the individual system and how it is integrated overall.
Some thoughts I have for best practices:
Backups ---
1) Nightly if possible
2) Tapes stored off site
3) Archives backed up through out day
4) To Disk then to Tape and leave backup on disk until next backup
Datafiles ---
1) Depending on hardware used.
a) separate datafiles from indexes
b) separate high I/O datafiles/indexes on dedicated disks/lungs/trays
2) file names representative of usage (similar to its tablespace name)
3) Keep them of reasonable size < 2 GB (again system architecture dependent)
Security ---
At least meet DOD - DISA standards where/when possible
http://iase.disa.mil/stigs/stig/database-stig-v7r2.pdf
Hope that gives you a start
Regards
tim

Custom Schedule Tasks (Administration WorkList)

Hi All,
Is possible create a custom schedule tasks? for example create a interface where I alter the period that execute the job?
Thanks
Ivo

Hello,
I don't think so you can do it dynamically through an interface.
But there is another approach to this.
Have a Process defined that has
1) a CO of type Service-External service, that reads an R/3 table through an RFC call. You maintain the period parameters in this table
2) a alternative/decision/process control block that checks for the period.
if true ,then proceed else loop back to 1)
3)a CO of type Process Control-Initiate Process (Using Predefined Template) that points to the process that you wanna start.
This is just a draft. You can make it look really good.
Cheers,
Mandrake!

Event on Servicing task status : best practice

hello,
I work on ORACLE Servicing module with Service requests, for each service request it could have some tasks to do, each task has got a status : I want to launch an email when for some status transition : ( Open to Close for example ).
What is the best way to do such a thing ?
- using workflow ?
- a trigger ?
or some other way.
( working on ORACLE APPLICATION 11i 11.5.9 )
Thanks.
Romeo.

How obnoxious! :-) This functionality already there.
If you check the the Notification checkbox in the task type setup, every update should send the notification to the owner of the task.
jtf_wf_task_events_pvt.publish_update_task raises the event.
jtf_task_wf_subscribe_pvt.update_task_notif_subs reads the event raised
Checks wthere the notification check box is enabled if yes
sends the notification using jtf_wf_task_util.create_notification (uses another workflow of item type JTFTASK).
Try it out. This code should give a good idea how it works.
Thanks
Nagamohan

Best Practices for Configuration Manager

What all links/ documents are available that summarize the best practices for Configuration Manager?
Applications and Packages
Software Updates
Operating System Deployment
Hardware/Software Inventory

Hi,
I think this may help you
system center 2012 configuration manager best practices
SCCM 2012 task-sequence best practices
SCCM 2012 best practices for deploying application
Configuration Manager 2012 Implementation and Administration
Regards, Ibrahim Hamdy

Best practices of BO/BW SSO SAP Authentication transports

Hi Friends,
We are going to integrate BW system with BO (SAP authentication). All the queries are built through BICS connections. And we have various reporting tools to implement SSO SAP authentication (Webi,Crystal,Dashboard.Design studio…etc)
As per the process there are certain activities which has to be performed at BW level
e.g -- BW Roles creation (PFCG---Crystal role enablement) and assigning to BO users
Once it is created in BW , we have to do integration at BO level( in CMC application) by selecting authentication and roles import followed by ……Groups..Users…folder and access level...
My question here is
Transports of BW objects for BO SSO (SAP) authentication (such as roles created for Users, Keystore certificate, uploads). Will these objects be transported by BW team or they will be separately downloading or uploading the certificate in different systems (like QAS ...PROD….)
And at BO level, once I integrate BO SSO, Do I need to do manual integration in QAS and Production system as well or it can be transported with promotion management of BO tool
Will these SSO(SAP) authentication can be applied to all tools in BI Launchpad such as (Design studio,Webi,Web application,Crystal….etc) as all users are required to have SSO to all BO tool
Regarding LUMIRA tool , Can we do SSO authentication
Please share your thoughts and experience.
I t would be great if I get BO administration best practices document for BW BO SSO and Users and Group management in CMC for implementing
Thanks in advance

Hi ,
Please find my answers below:
1. The roles will be created in BW and should automatically appear in BO CMC Authentication SAP roles, if there is a connectivity setup between BO and BW irrespective of the SSO.The roles are transported by the BW security team.
2. Every environement will have a unique connection to the corresponding SAP BW environment.For example SAP BW DEV will be mapped to BO DEV, SAP BW PROD will be mapped to BO PROD.So these settings cannot be migrated through Promotion Management.
3.This authentication can be applied to all tools , the SSO does not depend on the tool ,it depends on the integration between two systems which in this case are BO and SAP BW
As mentioned earlier, after integration all tools can have SSO
You can refer to a lot of help documents on this site which will help you to setup the integration between SAP BW AND SAP BO.
Kind Regards,
Priyanka

OIM - Making schedule task a dependent task

Hi,
Can some one suggest me , is it possible to make a schedule task, dependent on another schedule task in OIM.
Regards
Vicky

Start the second scheduled task using the APIs at the end of the first scheduled task.
Best regards
/Martin

Skipping of Scheduled Tasks

Hi All,
I have an scheduled tasks on windows Server 2008 Standard, Which were working fine from couple of years.
Now after windows Update we are facing the issue of skipping the tasks without any error in history tab. " Next Run Time " is
getting updated But the "Last Run Time" is in hold.
We had tried troubleshooting following steps:
1) Firstly, Windows update was cancelled & Restarted the server (Tasks started working fine with the End Result for 2 Days then Stopped)
2)Deleted all the tasks & scheduled the tasks again then restarted (Tasks started working again with the final outcome for few days then Stopped Issue started again)
3) Restored the system But no luck
Now we are confused and searched many Forums but we didn't find the solution.
We have 7 Tasks which triggers an .EXE File. It Runs Manually & do the process.
I have seen this System Task Running always "Certificate
Services Client automatically manages digital identities such as Certificates, Keys and Credentials for the users and the machine, enabling enrollment, roaming and other services" is this might be the reason..
Need the solution ASAP, I request all pro's to find me a solution.
Thanks

Hi Hidayath,
Please post detailed information about the task you have scheduled, and the detailed setting like the task's trigger and the task's action to help us to troubleshoot.
In addition, Cause The Task Scheduler may be conflicts to Automatic Updates service. Since some updates may require restarting the computer. At this point, the scheduled task will be temporary
hang. Please also try to temporarily stop the automatic update, check the tasks scheduled whether the same issue still exists.
Reference from this thread:
Task scheduler does not start scheduled
tasks reliably
Best Regards,
Anna

What is the best practice for implementing scheduled tasks in ADF?

Hi experts,
I'm using Jdev 12.1.3, and I'd need your advice in how implement scheduled tasks.
We have today a button that generates a Jasper pdf report correctly. The new requirement is to schedule a task that automatically send this pdf via email once a week.
Thanks in advance for your help.
Best regards,
Jose.

Refer
Andrejus Baranovskis Blog: Optimizing Long Running ADF Operations with Parallel WebLogic Time Manager Execution
http://www.gebs.ro/blog/oracle/timer-task-in-adf/
https://technology.amis.nl/2011/10/19/adf-faces-handle-task-in-background-process-and-show-real-time-progress-indicator-…

Dynamic Scheduling Best Practice -- IS-U-BF-PS E1DY E2DY

I have been tasked with resolving several long standing issues with My Companies Meter Reading Schedules. My question originates out of the desire to implement the eventual corrections I make as close to a best practice standard as possible.
Near the end of 2009 I extended the Dynamic Schedule Records out to the end of 2010 with transaction E1DY
At the beginning of 2010 I reported a program error which resulted in [Note 1411873|https://websmp130.sap-ag.de/sap(bD1lbiZjPTAwMQ==)/bc/bsp/spn/sapnotes/index2.htm?numm=0001411873&nlang=E&smpsrv=https%3a%2f%2fwebsmp103%2esap-ag%2ede&hashkey=9D07D6F4306CBF2AF0B69DEE0022142E| Schedule record: Previous period end in dynamic scheduling]
I requested clarification of the comment:
"In certain operational scenarios that are not explicitly forbidden (but which are strongly advised against), the end of the previous period of the first schedule record of a series of a year may not be calculated correctly in the dynamic scheduling"
& was advised:
it means such cases where you don't have a full sequence of MRU.
The standard process of dynamic scheduling is designed that you have for every day several readings (consilidated in meter reading units/ MRU).
There was no further clarification other than the confirmation that the configuration existing in our system did not match this ideal condition.
The Current Design of Dynamic schedules is as follows:
1. No Budget Billing implemented at all. All Portions defined with a parameter record Without Budget Billing configured
2. Several Groups of Monthly Portions allocated to Calendar Z3
2a.     21 Monthly Portions
2b.     21 Monthly Portions
2c.     21 Monthly Portions
2d.     21 Monthly Portions
2e.     21 Monthly Portions
2f.     20 Monthly Portions
2g.     1 Monthly Portion
2h.     1 Monthly Portion
-Please note, that this results in day 21 of 2a-2e not including day 1 of the 2f Monthly Portions as is intended. this results in manual movement of the 20 Monthly portions in transaction E2DY one by one.
-Please note, for portions in group 2d, & 2e there is a "gap" in the config where the factory Calendar is not Assigned for day 12 & 13 in the series. resulting in a gap in the schedule record creation.
3. Many Meter Reading Units are configured for each portion.
My intended changes to the configuration are as follows:
4. No change to Budget Billing
5. All Groups of 21 Monthly Portions (2a - 2e) share the same configuration, so change all Meter reading units for (2a - 2e) to 2b (least change)
6. 2g is configured the same as day 14 of groups 2a - 2e, move to 2b equivalent
7. 2h is configured the same as day 15 of groups 2a - 2e, move to 2b equivalent
8. 2f is configured on Calendar Z3, so update configuration to Calendar ZL
9. Generate schedule records for Calendars Z3 & ZL
Having read all the above, can anyone expert in the design & implementation of Dynamic scheduling think of any issues which may arise from updating the configuration as described.
If anything is unclear or stupid let me know, I'm definitely interested in feedback to help ensure the corrections are made smoothly, & to clarify what was the "operational scenarios that are not explicitly forbidden (but which are strongly advised against)" as mentioned in the SAP Note.
Also as a final question, how feasible would it be to delete the unused portions after these changes are migrated?
regards
Daniel
Edited by: Daniel McCollum on Sep 9, 2010 7:12 AM

I have started on point 8 first:
after moving all 2f portions to calendar ZL & reentering the Meter Reading Units to resync the calenadar configuration, I used E3DY to delete schedules on calendar ZL from a future date.
This has eliminated the offending schedules on these portions from the Z3 Calendar.
Point 9:
using E1DY to generate the schedules & E2DY to "merge" them with the end of the older schedules still on Calendar Z3 has resulted in the expected 20 day cycle.
I am now dealing with the portions still on the Z3 calendar by regenerating them via E1DY & moving to the correct dates via E2DY to verify the schedules.

Site Maintenance Task Best Practice

As per our understanding, we need to either enable "Clear Install Flag" task or "Delete Inactive Client Discovery Data" task.
please do let us know, what will be consequences if we enabled the both tasks & what are the best practices.
Prashant Patil

Clear Install Flag
task is highly dependent on heartbeat discovery. If you install client on computer and heartbeat sent the information to Site making its Install flag as Active in Database and at later stage ,If you uninstall client,still the Install Flag will be active
until it is discovered by heartbeat Discovery. When the client is not discovered by Heartbeat discovery,Install Flag will be cleared.
As a thumb rule,When
enabling this task, set the Client Rediscovery period to
an interval longer than the Heartbeat Discovery schedule.
More information about how Clear Install Flag works is given here http://myitforum.com/cs2/blogs/jgilbert/archive/2008/10/18/client-is-installed-flag-explained.aspx
Delete Inactive Client Discovery Data:
suggest you to look at technet document,its clearly explained http://technet.microsoft.com/en-us/library/bb693646.aspx
Eswar Koneti | Configmgr blog:
www.eskonr.com | Linkedin: Eswar Koneti
| Twitter: Eskonr

Any alternative beside CF Administrator scheduled task?

My scheduled tasks unable to run on CF9 but when I browse in IE it's working fine.
I believe CF9 scheduled task very sensitive on the code as I tried to remarks on some coding its working fine.
When I removed the remarks it unable to process.
Any help on this? Is there any other way to run a schedule without using CF Administrator?
Best regards,
Eric

Eric, is there any chance that the page you're running successfully in IE works because you were prompted at some point for a web server username/password? The browser will cache that for subsequent requests. If the page requires such security, you must specify it in the scheduled task definition.
There is also available logging of scheduled tasks (on the Logging Settings page in the CF Admin), which creates a new log in the \logs directory (also accessible from the CF Admin Log Files page), which may give you more insight into what's not working.
Finally, yes, you could always an alternative to CF's scheduled tasks, in the Windows scheduled task feature (available in all versions of Windows). The problem is how to execute a CFML page. There used to be a cfml.exe program in the \bin (prior to CF 6) that allowed you to execute CFML pages from the command line. That's no longer offered.
But you could call the pages using a command-line equivalent of a browser. One such solution is wget. I did a blog entry on this several years ago when I worked with BlueDragon, but the concept applies just as well to CF:
http://bluedragon.blog-city.com/executing_cfml_from_the_command_line_or_where_did_cfmlexe_ go.htm
Others may have still other suggestions.
But really, see first if you can in fact get it to work as a CF scheduled task. There's usually an explanation and a solution. Hope that helps.
/charlie
Providing CF troubleshooting services at carehart.org/consulting
[email protected]

Scheduled Tasks - Administrator Best Practices

Similar Messages

Maybe you are looking for