I recently set up a group managed service account to ditch the headache of password rotation. The account creation went smoothly. I was able to set up a service to run as the gMSA, and the account was given "Log on as a service" privileges. I also have some scheduled tasks I need to convert, but whenever I try to grant "Log on as a batch service" or "Create symlinks" privileges (via secpol.msc) to the account I get the following error:

"An extended error has occurred. Failed to save Local Policy Database."

I have tried this on several machines, all with the same result. Is this supposed to be possible, and if so, any suggestions on where to start digging for solutions? All servers are Windows Server 2012 R2 SP0.

Thanks in advance.

1 Answer 1


Yes, Group Managed Service Accounts can indeed be granted "Log on as a batch job" and "Log on as a service" rights, among others.

From the MS PFE blog:



In fact just go ahead and check out the entire post:


Make sure you're specifying the dollar sign in the name as shown.

  • I visited that link previously when setting up the gMSA. As you say, these permissions should be settable, but I get the same error on all of my machines when I try to do so. The fact that all of my machines are impacted is what gave me doubts. I have been unable to find anything to explain why this doesn't work. Mar 17, 2015 at 15:34
  • 1
    Hmm. I suspect a bug. Try using a command line tool, such as ntrights +r SeBatchLogonRight -u "SERVER\GMSA$" instead of the GUI.
    – Ryan Ries
    Mar 17, 2015 at 15:55
  • 1
    That worked Ryan. The ntrights utility was able to set these permissions. Log on as a service showed up because the services UI is able to handle gMSA, and added that permission automatically. Secpol.msc doesn't work with these accounts at all. I'll try to find the right team to file a bug against. Mar 18, 2015 at 16:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.