Register-ScheduledTask : Access is denied. (HRESULT 0x80070005)

user_6049705 0
Viewed 2771

I'm trying to create a new Windows Scheduler Task, which will run some sync job. The things are:

  • I want to use a separated service account, not Administrator
  • I want to run a job not to get tied with service account's password change. In Windows Scheduler Task it is a "Do not store password" check button ("-LogonType S4U" option below)
  • Job should be created by Powershell as job creation should be automated

I'm running commands below under local Administrator and get an error:

PS C:\Temp> $TaskAction = New-ScheduledTaskAction -Execute "cmd.exe" -Argument "<ARGUMENTS>"
PS C:\Temp> $TaskSettingsSet = New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Hours 3) -MultipleInstances IgnoreNew -DontStopIfGoingOnBatteries
PS C:\Temp> $TaskTrigger = New-ScheduledTaskTrigger -RandomDelay (New-TimeSpan -Minutes 40) -Weekly -DaysOfWeek Saturday -At 7:30am
PS C:\Temp> $TaskPrincipal = New-ScheduledTaskPrincipal -UserId "<SERVICE_USER>" -LogonType S4U
PS C:\Temp> Register-ScheduledTask -Action $TaskAction -Description "<DESC>" -Settings $TaskSettingsSet -Principal $TaskPrincipal -TaskName "<TASK_NAME>" -TaskPath "\" -Trigger $TaskTrigger
Register-ScheduledTask : Access is denied.
At line:1 char:1
+ Register-ScheduledTask -Action $TaskAction -Description "<DESC>"  ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : PermissionDenied: (PS_ScheduledTask:Root/Microsoft/...S_ScheduledTask) [Register-ScheduledTask], CimException
    + FullyQualifiedErrorId : HRESULT 0x80070005,Register-ScheduledTask

<SERVICE_USER> has been added to "Log on as a batch job" local policy. Permissions for C:\Windows\Tasks or C:\Windows\System32\Tasks set with iCACLS does not help. I've even added <SERVICE_USER> to local Administrators group - the same error.

If I do everything via GUI - it asks me <SERVICE_USER> credentials and works fine.

What permissions do I lack?

scheduled-tasks powershell windows
1 Answers

The thing was in user, running PS: if your need a "Do not store password" check button in your job, you need all the code above in PS console being ran under <SERVICE_USER> (you need to add <SERVICE_USER> to "Allow log on locally" local policy).

An Ansible example:

- name: Create and register sync task
  win_shell: |
    $TaskAction = New-ScheduledTaskAction -Execute "cmd.exe" -Argument "<ARGUMENTS>"
    $TaskSettingsSet = New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Hours 3) -MultipleInstances IgnoreNew -DontStopIfGoingOnBatteries
    $TaskTrigger = New-ScheduledTaskTrigger -RandomDelay (New-TimeSpan -Minutes 40) -Weekly -DaysOfWeek Saturday -At 7:30am
    $TaskPrincipal = New-ScheduledTaskPrincipal -UserId "<SERVICE_USER>" -LogonType S4U
    Register-ScheduledTask -Action $TaskAction -Description "<DESC>" -Settings $TaskSettingsSet -Principal $TaskPrincipal -TaskName "<TASK_NAME>" -TaskPath "\" -Trigger $TaskTrigger
  vars:
    ansible_become: yes
    ansible_become_method: runas
    ansible_become_user: <SERVICE_USER>
  register: sync_task
user_60497050
Related