1

I posted a question a while ago about allowing a specific user to start/stop Windows services.

Provide a user with service start/stop permissions

I decided to revisit the issue. I have no idea what I did differently this time, but the GPO finally allows my Backup user to start/stop the appropriate services. UNTIL I try to run a scheduled task as that user.

I have a batch file that stops a service, backs up / verifies the service's data, and restarts the service. If I open CMD as the Backup user and run the batch file, it works fine. If I create a scheduled task, set it to run as the Backup user regardless of whether the user is logged on, and have the task run same batch file, it is no longer able to stop / start the service (Error 5, access denied).

I assume this is because the user is not logged in, thus the GPO is not applied to its account. If that is the case how can I get this to work? I would rather like to avoid running the task as an Administrator.

1
  • 1
    Just an update, the user is in the Backup Operators group and I did verify via gpresult that the user has the Logon As A Batch Job right. – slakr007 Dec 13 '14 at 17:44
1

When running under the task scheduler the user has much less access to services. This is because access to the Service Control Manager which handles services it different for Authenticated Users than for Interactive Users.

Interactive users (the ones logged in) can enumerate, start and stop service, while non-interactive ones can't even enumerate them.

I wrote a blog post about this topic a while ago. It tries to explain what is going on and also provides a script to change permissions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.