up vote 0 down vote favorite
share [g+] share [fb]

I need to disallow one of the domain users to create new scheduled tasks and browse details of existing tasks on a certain machine (Win2008R2 in Win2008R2 domain). This user is a member of Users group on this machine. Here is what I already tried to do:

  1. Enabled Prohibit Browse and Prohibit New Task Creation in the Local Group Policy (both for Computer Configuration and for Users Configuration)
  2. Enabled Prohibit Browse and Prohibit New Task Creation in the Local Computer\Non-Administrators Policy
  3. Removed permissions for SYSTEM for HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Task Scheduler5.0 and changed Allow Browse and Task Creation keys to 0
  4. Created domain Group Policy for this user with Prohibit Browse and Prohibit New Task Creation enabled

Each of these operations was followed by gpupdate /force. Group Policy Results console shows that the policies are applied to the user.

Despite all of these user is still able to create new tasks and browse tasks details.

Am I missed something?

link|improve this question
What permissions does the user have to login to your servers? Try using the gpresult /r command and check what The user is a part of the following security groups says. – Nixphoe Jul 18 '11 at 13:33
@Nixphoe gpresult /r reports that the user is a member of the following groups: Domain Users, Everyone, BUILTIN\Users, NT AUTHORITY\INTERACTIVE, CONSOLE LOGON, NT AUTHORITY\Authenticated Users, This Organization, LOCAL, Test Group, Medium Mandatory Level. Where Test Group is just a security group inside OU without any special permissions. – Vader Jul 18 '11 at 14:08
feedback

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
or
required, but never shown
discard

Browse other questions tagged or ask your own question.