2

So I'm trying to run a powershell script on a schedule. Every morning at 6am, repeat every hour of the day. Here is the script itself:

Get-Content C:\Users\administrator\Desktop\users.txt | ForEach-Object {
    Set-AdUser -Identity $_ -LogOnWorkstations $null
}

Now, the script works flawlessly when I execute it myself. But it seems as if the script won't properly run when its being scheduled to execute. My thoughts is that the execution policy keeps asking if its safe to run the script prior to running it. If anyone else agrees that this might be the reason the script can't start on its own, could you please provide me a solution around this barrier?

2
  • 1
    What does Get-ExecutionPolicy -List say? What is the specific command lines for the scheduled task?
    – jscott
    Oct 8, 2015 at 12:30
  • 1
    Also, who does the task run as? Does that user have access to AD to modify the users' logonWorkstations attribute?
    – jscott
    Oct 8, 2015 at 12:37

4 Answers 4

4

Where is the sheduled task? On GPO or on a local machine? Are the script and the machine where it should run in the same network?

Try to schedule it like this (if you haven't done that yet):

Programm/Script: PowerShell.exe

Arguments: -ExecutionPolicy Bypass -Command "& 'FilePathToScript.ps1'"

Edit: Also I'm not quite sure if you have to have the AD-PS-Module installed on the Workstation where you want to run the script, because it could be that the command Set-ADUser cannot be found.

1

Execution policy is easy to check, can you run it as a script when you are logged on normally? If not then 'set-execution policy remotesigned', run from an administrative powershell session will set that globally for hte server.

The user that is executing the scheduled task needs to have 'Logon As Batch' rights to the machine that this is running on. given this is an AD module I assume you are running this on a Domain Controller, in which case you will need to amend the Default Domain Controller GPO to assign the right 'Log on as Batch' to your user. If this is running on a work station or member server with RSAT you need to use the local security policy to assign this right (SecPol.MSC).

The User that is running the script needs to have access to Active Directory to the level where it can amend user objects. Generally if you are logging onto a Domain controller you will have Domain Admin witch will give you this right but if you have created a service account it may not have the right permissions. You will need to investigate the permission level required and apply this to the relevant areas of your AD Domain. Careful with this.

I'd bet it was the Log on as Batch right, its caught me out a few times and isn't obvious when its stopping you.

If you need to investigate further Scheduled Tasks history tab can help, as can event viewer.

0

Execution Policy is machine wide. If it works interactively, it doesn't seem likely it would be an issue when running as a scheduled task.

What you are missing here is information. You aren't going to get any information with two commands and no logging. And you aren't loading the Active Directory module so that may explain a few things.

Here is an example of how to launch a PowerShell script as a scheduled task and log the output:

Program/Script: PowerShell  
Arguments:  
-NonInteractive -WindowStyle minimized -c "powershell -c C:\Apps\AppName\SomeScript.ps1 -verbose > C:\Apps\AppName\Logs\SomeScript.log 2>&1"  

Here is an example of loading the Active Directory module:

$startTime = Get-Date
$logDateFormat = "yyyy-MM-dd HH:mm:ss"
[console]::WriteLine("{0} Loading Active Directory Module", [datetime]::Now.ToString($logDateFormat))
import-module ActiveDirectory  

Get-Content C:\Users\administrator\Desktop\users.txt | ForEach-Object {  
    [console]::WriteLine("{0} Clearing workstations for user: {1}", [datetime]::Now.ToString($logDateFormat), $_)
    Set-AdUser -Identity $_ -LogOnWorkstations $null
}

$endTime = Get-Date
[console]::WriteLine("{0} Finished.  Time Required: {1}", [datetime]::Now.ToString($logDateFormat), $endTime.Subtract($startTime).ToString())
0

It will be something like this program / script Powershell.exe Argument and path

 -ExecutionPolicy Bypass -File "C:\alert.ps1"

enter image description here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .