Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to set up a scheduled task which will work under the Network Administrators account, whether the account is logged in or not (on a specificed computer)

According to the Task Scheduler, I need 'Logon as batch job rights'.

Attempting to change this setting in the Local Security Policy window has it the option to add the Administrator account to the groups greyed out. Currently, only LOCAL_SERVICE may Logon as Batch job. Attempting to add administrator to this group hasn't worked. How do I make it able to set this permission so that I can run tasks if I'm logged in or not?

share|improve this question

Run RSOP.msc to determine if there is a GPO that manages the system and diables your ability to make changes

share|improve this answer
The source GPO is Default Domain Controllers Policy. How to change this to add the network administrator account to it, I do not know! – Brohan May 5 '10 at 15:32
You will need to work with the administrator of the doamin. Unless that is you.:-) – Dave M May 5 '10 at 16:07

sounds like a gpo is controlling this, if so then you'll need to talk to your admins about this issue.

share|improve this answer

By default (if you do not modified existing default GP or created some new GP) this Local Policy is overridden by Default Domain Controllers Policy (the way to confirm is rsop.msc - Resultant Set Of Policies tool which will show you actually applied policies) on domain controllers. So it looks like you are trying to do this on Domain Controller and see that "Add User or Group..." and "Remove" buttons are grayed out in Local Group Policy Editor (gpedit.msc).
RSOP tells you that currently added users are defined by Default Domain Controllers Policy, so you either have to edit this policy and add users/group or disable this policy in Default Domain Controllers Policy so that it became "Not defined" there - after this local policy became "editable". You can do this in Group Policy Management console (gpmc.msc), given the fact that you have required rights.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.