0

I successfully followed the detailed instructions in this Technet blog post on setting up a group managed service account called 'locSchedAccount' on a Windows Server 2016 Standard machine acting as domain controller.

I wanted to use this service account to run scheduled tasks.

Essentially, I used Powershell cmdlets:

Add-KDSRootKey -EffectiveImmediately
New-ADServiceAccount -Name locSchedAccount -DNSHostName locSchedAccount.my.corp -PrincipalsAllowedToRetrieveManagedPassword "Domain Controllers"
Install-ADServiceAccount locSchedAccount

I added locSchedAccount to the Group Policies: 'Log on as a batch job' and 'Allow log on locally'.

I also added locSchedAccount to the Active Directories group "Domain Controllers".

Then I forced a policy update: gpupdate /Force

Then I executed the following on Powershell to create a scheduled task under this account:

$action = New-ScheduledTaskAction "C:\Windows\System32\notepad.exe"
$trigger = New-ScheduledTaskTrigger -At 07:10 - Daily
$principal = New-ScheduledTaskPrincipal -UserID mydomain\locSchedAccount$ -LogonType Password -RunLevel Highest
Register-ScheduledTask mynotepadtask -Action $action -Trigger $trigger -Principal $principal

Now when I open the Task Scheduler, I see a new task "mynotepadtask".

I tested it by clicking on Run and it fails immediately:

Task Scheduler failed to start \mynotepadtask task for user "mydomain\locSchedAccount$". Additional Data: Error Value: 2147943785

Which error means that the account is not set up for batch jobs. But as mentioned above, I did explicitly add it to the group policy.

So then I repeated the above by putting the locSchedAccount into "Administrators" group.

This time, my error when I attempt to run the task is:

Task Scheduler failed to start \mynotepadtask task for user "mydomain\locSchedAccount$". Additional Data: Error Value: 2147943726

Which now means 'unknown user or bad password'.

What am I doing wrong?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.