2

I have created a new group managed service account in AD and added two servers to access the account. I am able to use the account in services.msc. It is accepting it there but when I am trying to schedule task in Task scheduler (using PowerShell command) I am getting error that user name or password is incorrect.

Register-ScheduledTask : The user name or password is incorrect.
At line:4 char:1
+ Register-ScheduledTask myAdminTask –Action $action –Trigger $trigger  ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : AuthenticationError: (PS_ScheduledTask:Root/Microsoft/...S_ScheduledTask) [Register-ScheduledTask], CimException
    + FullyQualifiedErrorId : HRESULT 0x8007052e,Register-ScheduledTask

The command I am using is this:

$action = New-ScheduledTaskAction  "C:\Users\admin\Desktop\backup.cmd"
$trigger = New-ScheduledTaskTrigger -At 23:00 -Daily
$principal = New-ScheduledTaskPrincipal -UserID abc\gmsa$ -LogonType Password 
Register-ScheduledTask myAdminTask –Action $action –Trigger $trigger –Principal $principal

I am using the right syntax for username (domainname\serviceaccount$).

FYI : I am testing this on Windows Server 2016 on Azure cloud.

1
  • 1
    This was simply not possible with earlier versions of Windows as noted here: docs.microsoft.com/en-us/previous-versions/windows/it-pro/…. As for WS2016, I've not tired nor have I seen it done. Before trying to do this with PowerShell, try it using the GUI. If it cannot be done in the GUI, then, there should be no expectation you can do it in code. Yet even with WS12, there were similar issues, playing around with the task trigger, ended up working, using run once, then try an run it, then set it back to Daily and see if it sticks
    – postanote
    Jan 21, 2019 at 1:32

2 Answers 2

2

Found the solution for the problem. Only thing that needs to be done after added the computer in a security group which access group managed service account is to reboot the server once to reflect membership changes. After reboot I was able to add the account using powershell.

P.S :- Thanks for your reply postanote, I really appreciate it. :)

1
  • No worries, glad it lead to a workaround. You probably could have made it work by doing a gpupdate / force and restart the registry, stop and restart the service, which is what the reboot does, amongst other stuff that spins up.
    – postanote
    Jan 22, 2019 at 0:53
0

another option is to run 'klist purge –li 0x3e7' to force system to retrieve new ticket to update computer group membership and allow to retrieve service account password

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .