0

On a 2008 R2 server, I have a Windows task that executes a PowerShell script. It works fine when set in Task Scheduler to execute as an Admin account, but I'd like to set it to execute as the Windows Local Service account instead as I'd read that it's considered a security best practice since Local Service has very limited privileges.

When using the Local Service account, the task itself appears to run the PowerShell script successfully according to the history log in the task scheduler. But the PowerShell script does not output a text file as it's designed to do, leading me to believe that perhaps the PowerShell.exe itself ran, but the script was blocked for some reason.

In the task scheduler, I have the task set to "Run with highest privileges" so thought that was all I needed to get it to run successfully...

How can I get this PowerShell task to run successfully? Or should I just create a Windows domain service account to run this task instead?

  • Where is the script writing the output? Are you trying to write to the network or something? You probably won't have any network access as that account, but lots of access to the local system. – Zoredache Mar 13 at 21:10
  • The script is writing the output to the local C: drive... And to clarify, I'm trying to use "Local Service", not "Local System". Local System definitely works but I'd like to avoid that since it has admin privileges. – 72909903 Mar 13 at 21:42
  • Well does the account you are running it as have write rights at the path you are trying to write to? Does the account have enough privileges to actually run the commandlets that you are trying to run? – Zoredache Mar 13 at 21:58
  • Ah, thanks Zoredache... Indeed, the Local Service account is not listed as having permissions to the C: drive. System account is listed though and has full permissions of course. Looks like I'd have to grant the Local Service account read/write permissions to the C: drive. But we want to avoid that so we're now looking into just creating our own custom service account to run this task, granting it only the bare minimum permissions it needs to do its job as per best practices. Thanks again. – 72909903 Mar 13 at 23:40
  • Also, learned that setting Windows task to "Run with highest privileges" has some caveats to it: social.technet.microsoft.com/Forums/windows/en-US/… – 72909903 Mar 13 at 23:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.