Running Scheduled Tasks Remotely Without Full Administrator Rights

[Ryan]

I'm trying to setup a user to be able to run a scheduled task on a remote
server using the following command:

schtasks /run /s MyServer /TN MyTask

Of course, this works fine if I make the user a local administrator on the
server hosting the scheduled task. But...I don't want this user to have full
administrator rights on the server.

I gave the user read/execute permissions on the security tab for the task
itself. I've also given the user "Log on as a batch job" permissions in the
local security policy, but I am still getting an "ERROR: Access is denied."
message.

As a work around I also tried giving a test user RDP access to the server to
see if that would do the trick, but I get an "Access is denied" message when
I click on the Scheduled Tasks icon in the control panel.

Anyone have any ideas on this one?

[Dragos CAMARA]

try to create the scheduled task with the test user.

I'm also trying to do this...

It seems that in order to CREATE a task, one must be an administrator.
I also cannot find any way to allow a user to CREATE a task without being an
administrator.

[Herb Martin]

What if you give the user "Run as Batch" right explicitly?

This should work to Schedule and RUN the task locally (in the Task
Scheduler)
but the user may need more privilege depending on what the task actually
does.

[Matt Callaghan]

One thing to note however is that users are REMOTELY scheduling tasks (over
the network).

Where is "Run as Batch"?
.... I don't see it as a group.

[Herb Martin]

It is not -- it is a Right. But you might create such a Group, give the
right, and make it easy to give the right by adding someone to the
group (if you don't already have users in a large number of groups.)

Check RIGHTS not groups.

Adding the user to the "Log on as Batch" group policy does not allow them to
schedule tasks still....

What else can we try?

[Herb Martin]

Run as Batch. There is no Logon as Batch unless you created that.

See if they can schedule a batch locally. The remote scheduler may require
admin (like) privileges.

[Matt Callaghan]

I think this is the problem, windows by default requires administrator
rights to be able to remotely schedule tasks to be run on a server.

What I'm trying to determine is if there is a group policy object somewhere
that we can set which would allow a certain set of users (i.e. members of
group "Task Schedulers" for example) to schedule tasks to be run as "System"
without being an administrator.

PS: I still don't understand what you mean by : "Run as Batch". Could you
please give a specific example as to how I can allow a user this privilege?

[Herb Martin]

Run as Batch is a RIGHT, like Logon Locally, or Change System Time.

You can set this in the Local settings of Computer Management or for many
computers/users through a Group Policy in the Computer->Security settings.

There is some right that is sufficient for setting the Task to run remotely,
there
has to be because that is how Admins do it. Whether this is a "single"
right
or a bunch of them that would practically make the remote person an admin
I do not know, but if you haven't given the users "Run as Batch" yet then
you have NOT really tested it.

[tarobap]

I realize this is a really old message, but I wanted to add to this: the user needs to have "Write" permissions on the task. Also, an admin does need to create the task. So, what I do is I create the task using schtasks and then add "Write" permissions to the "Users" group allowing all users to run the task.