Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm attempting to create a SQL Agent job that will run a PowerShell script that is saved on my system. However, the job fails with the following error:

A job step received an error at line 1 in a PowerShell script. The corresponding line is 'g:\PowerShellShare\Get-LastDBBackups.ps1'. Correct the script and reschedule the job. The error information returned by PowerShell is: 'AuthorizationManager check failed.

If I add the proxy account to local admins, it works, so it appears to be a permissions problem (leaving the account in local admin isn't an option for my environment).

The Windows Security log shows multiple Audit Failures with Event ID 4656 every time I run the job, all of them are from the proxy account attempting to access an object:

Object:
Object Server:      SC Manager
Object Type:        SERVICE OBJECT

A quick sc sdshow scmanager showed that Authenticated Users should have the access to scmanager:

D:(A;;CCLCRPRC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)

Most puzzlingly, if I RUNAS the proxy account on the server and run the script, it runs just fine. It doesn't matter what script I attempt to run via the SQL Agent Job, attempting to execute any script results in the same behavior. I can however run other PowerShell commands, just not execute any scripts.

Hoping someone has run into this before and could point me in the right direction.

UPDATE: It seems the major problem is that when I'm executing from the SQL Agent Job, my proxy account isn't a member of the interactive implicit security group. It looks like that group is granting the proxy whatever permissions it needs to run the job successfully when I test it using RUNAS. I'm not able to track down all the permissions this group allows.

The Audit Failures I was seeing were for the WinHttpAutoProxySvc and CryptSvc services. I used sc sdshow and sc sdset to modify the permissions to those specific services so that the Authenticated Users permissions matched those of the Interactive Users group. The audit failures are now gone, but I still get the same error message in SQL when I execute the job.

share|improve this question
1  
What about the location of the script and the working directory? Are the permissions on both of those set such the script should have permissions to access and run with the account it's running under? And is it possible to change those to a location that everyone or all users have permissions to access and execute from? –  HopelessN00b Dec 28 '12 at 20:36
    
The script that you want to execute from SQL Agent has to be accessible by the service account that the SQL Server Agent is using. So if you want the script to reside on your system, seperate from the SQL Server instance, the account has to have access to your system and the directory. –  Shawn Melton Dec 28 '12 at 20:41
    
The script is in a directory the proxy has access to, and the working directory is the same (I changed it to a different directory just to be sure). I can RUNAS the proxy and execute the script fine, it's only when I attempt to run it from within a SQL Agent Job step that I have these problems. –  MaddHatter Dec 28 '12 at 20:42
    
@ShawnMelton: The agent has access to the folder. I added the Agent account to local admins just to be doubly sure, to no effect. –  MaddHatter Dec 28 '12 at 20:44
    
How are you calling the script within the Job Step? –  Shawn Melton Dec 28 '12 at 21:00

1 Answer 1

Check your execution policy within Powershell; sounds like it might be failing because the default setting is "Restricted", which only allows Powershell to run as an interactive shell, and does not execute scripts at all. See the following link for details:

http://technet.microsoft.com/en-us/library/ee176961.aspx

EDIT: Just realized the above link only describes syntax for "Set-ExecutionPolicy"; this link should provide some additional context also:

http://technet.microsoft.com/en-us/library/ee176949.aspx

share|improve this answer
    
Created a job with: Get-ExecutionPolicy, what I got in return was: A job step received an error at line 1 in a PowerShell script. The corresponding line is 'get-executionpolicy'. Correct the script and reschedule the job. The error information returned by PowerShell is: 'Access denied The log is full of the 4656 errors as well. But I happen to know the execution policy is RemoteSigned, and that this script is not from the interwebs –  MaddHatter Dec 28 '12 at 20:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.