I successfully followed the detailed instructions in this Technet blog post on setting up a group managed service account called 'locSchedAccount' on a Windows Server 2016 Standard machine acting as domain controller.
I wanted to use this service account to run scheduled tasks.
Essentially, I used Powershell cmdlets:
Add-KDSRootKey -EffectiveImmediately New-ADServiceAccount -Name locSchedAccount -DNSHostName locSchedAccount.my.corp -PrincipalsAllowedToRetrieveManagedPassword "Domain Controllers" Install-ADServiceAccount locSchedAccount
I added locSchedAccount to the Group Policies: 'Log on as a batch job' and 'Allow log on locally'.
I also added locSchedAccount to the Active Directories group "Domain Controllers".
Then I forced a policy update: gpupdate /Force
Then I executed the following on Powershell to create a scheduled task under this account:
$action = New-ScheduledTaskAction "C:\Windows\System32\notepad.exe" $trigger = New-ScheduledTaskTrigger -At 07:10 - Daily $principal = New-ScheduledTaskPrincipal -UserID mydomain\locSchedAccount$ -LogonType Password -RunLevel Highest Register-ScheduledTask mynotepadtask -Action $action -Trigger $trigger -Principal $principal
Now when I open the Task Scheduler, I see a new task "mynotepadtask".
I tested it by clicking on Run and it fails immediately:
Task Scheduler failed to start \mynotepadtask task for user "mydomain\locSchedAccount$". Additional Data: Error Value: 2147943785
Which error means that the account is not set up for batch jobs. But as mentioned above, I did explicitly add it to the group policy.
So then I repeated the above by putting the locSchedAccount into "Administrators" group.
This time, my error when I attempt to run the task is:
Task Scheduler failed to start \mynotepadtask task for user "mydomain\locSchedAccount$". Additional Data: Error Value: 2147943726
Which now means 'unknown user or bad password'.
What am I doing wrong?