We are having an issue that appears to be domain wide. We First noticed this issue when attempting to install Metaframe Presentation server 4.5 during a trace of the installation I found that the issue is derived from the installers inability to create a scheduled task. I have been able to reproduce the problem reliably. Before adding a Windows Server or workstation to the domain we are able to create scheduled tasks however as soon as the server/computer is added to the domain we lose the ability to create scheduled tasks. If the Server/workstation is then removed from the domain the problem still occurs. The error is Scheduled task could not be created error 0x80070005. I have seen fixes for .BAT files however this effects any file attempted (.exe .bat...). I have attempted to schedule tasks with the Domain Admin credentials logged in as the domain admin. What is troubling is that it is system wide...

Is there a Group policy or a Domain security policy that needs to be changed?

I do not know when this issue began as I am new to this position.

Any help would be greatly appreciated.

  • add a windows tag? – Johan Aug 12 '09 at 19:01

0x80070005 is an "E_ACCESSDENIED" error.

The Resultant Set of Policy (RSoP) tool is your friend.

Run an RSoP on an affected computer (Start / MMC / Console / Add-Remove Snap-Ins / Resultant Set of Policy / Add / Close / OK, Right-click the "RSoP node in the left pane and do "Gather RSoP Data...", take defaults) and see if you see any group policy settings applying to the computer.

It sounds like somebody is pushing down a filesystem policy to modify the NTFS permissions on the %SystemRoot%\Tasks folder, but that's just a guess.

  • This helped find the issue. It was a Domain security policy that was put in place to thwart conficker that removed write and modify from %SystemRoot%\tasks Thank you sooo much we have been fighting with this one for a couple months Mathew Russell – user16508 Aug 12 '09 at 19:49

You can probably override the domain policy with a "user policy script". I don't know how to do them though. Its advanced stuff. Probably easier to just edit the main policy in the domain controller.

The policy might be called "Logon as Batch job"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy