3

Currently I'm using LOCAL SERVICE as the user account for various regular tasks, and was wondering if it was possible to use a Virtual Account instead.

Task Scheduler seems to reject NT SERVICE\ style account names.

1

You can't run it as a virtual user account. But you can run it with a virtual group account. (But since that that "group" has a 1:1 relationship with the task, it effectively is a user).

Lets say you run your scheduled task as the Local Service user. That group has a series of SIDs in its token:

Local Service:

  • Everyone (S-1-1-0)
  • Local (S-1-2-0)
  • NT AUTHORITY\Authenticated Users (S-1-5-11)
  • BUILTIN\Users (S-1-5-32-535)

Task Scheduler runs tasks with an additional SID that computed from the tasks's name.

You can manually "hash" a task name into an SID by running:

>schtasks /showsid /TN "The quick brown fox jumped over the lazy dog"
SUCCESS: The SID "S-1-5-87-2312335432-65297056-3549082870-2589977271-250352331" for the user name "The quick brown fox jumped over the lazy dog" has been computed successfully.

The task doesn't have to exist; it shows you the SID it will use when a task with that name runs.

  • Task name: The quick brown fox jumped over the lazy dog
  • Associated SID: S-1-5-87-2312335432-65297056-3549082870-2589977271-250352331

This means that when your scheduled task runs, it will have a new SID in it's security token:

Local Service:

  • Everyone (S-1-1-0)
  • Local (S-1-2-0)
  • NT AUTHORITY\Authenticated Users (S-1-5-11)
  • BUILTIN\Users (S-1-5-32-535)
  • NT TASK\The quick brown fox jumped over the lazy dog (S-1-5-87-2312335432-65297056-3549082870-2589977271-250352331)

With the tag of this new group SID in the token, you can edit the permissions on files and folders so that only the scheduled task can access them:

>icacls icacls yellow.png /grant "*S-1-5-87-2312335432-65297056-3549082870-2589977271-250352331:(M)"

enter image description here

1

No you cannot. Virtual Service Accounts are designed to run Windows Services and that's it. A Virtual Service Account has its own SID and Windows periodically and automatically changes the password of the VSA for security. The account can be assigned access control entries on an ACL. However, the account is not even stored in the SAM registry hive, which is why you won't see the account in most administrative tools.

From Chatper 6 of Windows Internals, Sixth Ed., by Mark Russinovich, David Solomon and Alex Ionescu.

Edit: It should also be noted that if a Virtual Service Account, which is running a Windows Service, attempts to access a network resource, it does so using the account of the computer it's running on, such as SERVER01$@domain.com.

1

edit: Actually it depends on what you really want to achieve. Provided you want to secure resources the task is accessing with ACL - here is the way:

Ability in Windows 7 and Windows Server 2008 R2 to apply a SID to every scheduled task and use that SID to apply permissions elsewhere in the Operating System. http://blogs.technet.com/b/craigf/archive/2011/03/15/using-delegation-in-scheduled-tasks.aspx

Scheduled Tasks do have a specific SID

edit: Added descripton for link.

  • It may be better to include the essential parts of the blog post you refer to in your answer to prevent eventual link rot. – Deer Hunter Dec 9 '14 at 23:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.