3

I've created a powershell script that runs Chocolatey updates as well as does some logging locally and on a network share. The script itself resides on a network share, and I'm hoping to be able to have clients run it from there.

The idea is that I deploy the scheduled task to run the script via GPO. I've tried doing so as with a computer policy and a user policy, and defining the active directory service account in the scheduled task GPO gui.

For actions, I chose powershell.exe -NonInteractive -WindowStyle Hidden -ExecutionPolicy bypass -file \\networkshare\scripts\script.ps1

Under security options I define the service account to run the task and check "Run whether user is logged on or not", and "Run with highest privileges"

This service account, for troubleshooting purposes is the OUADMIN group, and I confirmed that the account has access to the network share.

I apply the GPO to my machine, check in event log, and I find this error:

The computer 'ChocoUpdate' preference item in the Chocolatey Sch Task Testing {BDF8E170-C909-4115-8909-D42792DF977A} Group Policy Object did not apply because it failed with error code '0x80070005 Access is denied.' This error was suppressed.

What am I missing here? Is there a better way to do this?

3

This error indicates a permissions issue with the GPO, not with your script. You can verify this by scheduling it manually in task scheduler on the local machine and checking that it works then (and/or manually running the task).

Check the permissions on the GPO under Security Filtering on the Scope tab, and also check the granular permissions on the Delegation tab. The computer account to which you're assigning the GPO must have appropriate permissions to read and run the GPO.

4
  • Thanks for your response Matt. If I'm understanding you correctly, you want me to grant the AD service account to the GPO. I've done that in both areas that you mentioned (Delegation and Security Filtering). Unfortunately, the error message persists. Also possibly worth noting, Authenticated Users both have access. – greasewiz Jun 3 '15 at 18:24
  • No, not the service. The problem is that the group policy object is not applying, because access to the group policy object is denied. It looks like you have a computer called ChocoUpdate. This is effectively an account in AD, and it does not have the appropriate permissions to read and/or apply the GPO. – Matt Jun 3 '15 at 23:27
  • ChocoUpdate is actually the name of the scheduled task. I've added AD\Domain Computers to security filtering and delegation, and I've added my test computer into security filtering/delegation just to make sure. I still get that same error. – greasewiz Jun 4 '15 at 13:21
  • aha! I've got it. I've changed it so that the scheduled task is run by NT AUTHORITY\SYSTEM, and that did the trick. Thanks again for your help, Matt! – greasewiz Jun 4 '15 at 17:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.