Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to run a Scheduled Task on a 2008 R2 Domain Controller and all was well until I set it into the production environment. I'm running the task as a Domain User that's defined in the "Log on as a batch job" setting. For giggles I also added the account to "Allow log on locally" after the former failed.

When I'm prompted for the password after setting up the task I receive the error: "An error has occurred for the task ########. Error message: The following error was reported: Logon failure: the user has not been granted the requested logon type at this computer.."

I'm thinking that because this a DC that maybe it needs something else?

share|improve this question

2 Answers 2

Did you check if the account has the "Allow log on locally" right in the Domain Controller? This is done in the Domain Controller Security Policy:

GroupPolicyObjectName [DomainControllerName] Policy/Computer Configuration/Windows Settings/Security Settings/Local Policies/User Rights Assignment

As stated in: http://technet.microsoft.com/en-us/library/cc785165%28WS.10%29.aspx

EDIT: there is a "Logon as service" privilege for the user.

HTH

share|improve this answer
    
I did try that out and it didn't work. Ultimately, I don't want this account to be allowed to log on locally though. I only want it to run the scheduled task. –  silmaril8n Feb 8 '12 at 18:43

"Log on as batch job" should be all the account needs to run a simple task on the DC. How did you give the account that permission? In a vanilla 2008 R2 AD, that privilege is configured in the Default Domain Controllers Policy GPO to include:

  • BUILTIN\Performance Log Users
  • BUILTIN\Backup Operators
  • BUILTIN\Administrators

In order to add a user or group to that list, you'd either have to edit that policy or create a new policy to override that setting. Since editing MS default policies is a bad idea, you should create a new policy with the setting overridden. Make sure you include the default groups listed above as well as the user you're trying to give access to. This particular setting gets overwritten (rather than merged) if there are multiple policies trying to configure it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.