5

Currently I'm using LOCAL SERVICE as the user account for various regular tasks, and was wondering if it was possible to use a Virtual Account instead.

Task Scheduler seems to reject NT SERVICE\ style account names.

3 Answers 3

4

You can't run it as a virtual user account. But you can run it with a virtual group account. (But since that that "group" has a 1:1 relationship with the task, it effectively is a user).

Lets say you run your scheduled task as the Local Service user. That group has a series of SIDs in its token:

Local Service:

  • Everyone (S-1-1-0)
  • Local (S-1-2-0)
  • NT AUTHORITY\Authenticated Users (S-1-5-11)
  • BUILTIN\Users (S-1-5-32-535)

Task Scheduler runs tasks with an additional SID that computed from the tasks's name.

  • The SID will be a child of authority S-1-5-87
  • and will have a name of the form NT TASK\[Task Name]

The relative id 87 comes from the constant defined in winnt.h:

SECURITY_TASK_ID_BASE_RID  (0x00000057L)

You can manually "hash" a task name into an SID by running:

>schtasks /showsid /TN "The quick brown fox jumped over the lazy dog"
SUCCESS: The SID "S-1-5-87-2312335432-65297056-3549082870-2589977271-250352331" for the user name "The quick brown fox jumped over the lazy dog" has been computed successfully.

The task doesn't have to exist; it shows you the SID it will use when a task with that name runs.

  • Task name: The quick brown fox jumped over the lazy dog
  • Associated SID: S-1-5-87-2312335432-65297056-3549082870-2589977271-250352331
  • Group name: NT TASK\The quick brown fox jumped over the lazy dog

This means that when your scheduled task runs, it will have a new SID in it's security token:

Local Service:

  • Everyone (S-1-1-0)
  • Local (S-1-2-0)
  • NT AUTHORITY\Authenticated Users (S-1-5-11)
  • BUILTIN\Users (S-1-5-32-535)
  • NT TASK\The quick brown fox jumped over the lazy dog (S-1-5-87-2312335432-65297056-3549082870-2589977271-250352331)

With the tag of this new group SID in the token, you can edit the permissions on files and folders so that only the scheduled task can access them:

>icacls icacls yellow.png /grant "*S-1-5-87-2312335432-65297056-3549082870-2589977271-250352331:(M)"

enter image description here

Bonus Chatter

Kudos for running your tasks as Local Service - that is the right choice. It is a special row-rights account, which nobody can login as, and has no rights (aside from the same rights "anonymous" users get) on the network. Many "security experts" have it in their head that tasks need to be run with a special account they create in Active Directory with a complex random password. It makes me so crazy that these people don't understand the basics of security.

Bonus Reading

1
  • Fantastic answer. Exactly what I was looking for! Jan 11, 2023 at 13:09
3

edit: Actually it depends on what you really want to achieve. Provided you want to secure resources the task is accessing with ACL - here is the way:

Ability in Windows 7 and Windows Server 2008 R2 to apply a SID to every scheduled task and use that SID to apply permissions elsewhere in the Operating System.

TechNet Blog: Using Delegation in Scheduled Tasks archive - Craig Forster, March 15, 2011

Scheduled Tasks do have a specific SID

1
  • It may be better to include the essential parts of the blog post you refer to in your answer to prevent eventual link rot. Dec 9, 2014 at 23:00
2

No you cannot. Virtual Service Accounts are designed to run Windows Services and that's it. A Virtual Service Account has its own SID and Windows periodically and automatically changes the password of the VSA for security. The account can be assigned access control entries on an ACL. However, the account is not even stored in the SAM registry hive, which is why you won't see the account in most administrative tools.

From Chatper 6 of Windows Internals, Sixth Ed., by Mark Russinovich, David Solomon and Alex Ionescu.

Edit: It should also be noted that if a Virtual Service Account, which is running a Windows Service, attempts to access a network resource, it does so using the account of the computer it's running on, such as [email protected].

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .