Scheduled task does not run if logged out 1

[mkrausnick]

The task has been running faithfully every night for several years with the computer logged in 24/7. I decided that it would be more secure to log out at night. Now the task does not run, it says "could not start". I re-entered the password for the user account in task settings; no help.

If I log in without changing the task settings in any way (except to update the start time for re-test), the task runs.

The account is a domain-level account with membership in the local machine administrators group.

Any idea what might be causing this?

Mike Krausnick
Dublin, California

 

[franklin97355]

Have you tried changing the uset to SYSTEM?

 

[mkrausnick]

No, that wouldn't be feasible. The login maps several network drives in a specific configuration. I really need to log in as that user. It runs when I leave the computer logged in, it should work when I log out too, shouldn't it?

Mike Krausnick
Dublin, California

 

[franklin97355]

If you logout you loose the drive mappings. just what is it you are trying to do?

 

[bcastner]

Upgrade the machine to Windows XP Professional at the Service Pack 2 level.

I am not convinced there is an alternative under Win2k. Nor under XP Service Pack 1. This level of impersonation/authentication requires Service Pack 2.

 

[longhair]

mkrausnick,
why log out? w2k just lock the workstation and the jobs will run fine.
hth
regards,
longhair

 

[mkrausnick]

Locking the computer worked like a charm! I should have thought of that. An interesting side-effect is that the task is not displayed while running with the computer locked, but displays when I log back in.



Mike Krausnick
Dublin, California

 

[longhair]

mkrausnick,
do you need it to display? if just a .bat job

@echo off

in the first line should hide the dos window.
regards,
longhair

 

[mkrausnick]

No, it doesn't matter whether it displays or not. It makes sense for it not to display.

Mike Krausnick
Dublin, California

 

[bcastner]

sigh.

You need some authority to run the task.

http://support.microsoft.com/?kbid=310715

http://support.microsoft.com/defaul...port/kb/articles/q311/1/19.asp&NoWebContent=1

 

[mkrausnick]

The account is a domain-level account with membership in the local machine administrators group.

Authority is not a problem. I gathered from your prior post that Win2K does not run scheduled tasks when no user is logged in.

That's cool - Longhair's solution works just fine.

Mike Krausnick
Dublin, California

 

[bcastner]

You mean this: "why log out? w2k just lock the workstation and the jobs will run fine.
hth"

If you are happy with that as a solution, fine. This is a serious and significant security risk that cannot be suggested as a general solution.

 

[longhair]

bcastner,
please elaborate. how is only locking the workstation 'a serious and significant security risk'?
regards,
longhair

 

[bcastner]

Because any local Administrator account can unlock the workstation.

Best regards,
Bill

 

[longhair]

bcastner,
i thought you may be refering to the cached lmhash. if you are logged off, any local admin can log in - all they need to do is change from domain to workstation.
if i remember correct, scheduled tasks are actually part of a user profile - for example user1 has job a and user2 has job b. when user1 is logged in and goes to scheduled tasks they will only see job a, not job b.
i hope that the user is logging in with a regular account and set the batch job to run as the domain account. this will provide some more security.
as an additional question, how would you run a scheduled task that needs network access from a machine that is not logged in (authenticated) to that domain?
regards,
longhair

 

[mkrausnick]

Longhair, I think Bill's first post indicated that it isn't possible for a scheduled task to run W2K if the workstation is logged off, although it is possible in XP. I don't share Bill's security concern though because the local administrator won't be able to reach the network data unless the account are also a domain account, in which case, network security would apply.

The local machine administrator issue login issue has another interesting side in that if my app locks the workstation when it starts (which it does, since it runs all night), and an administrator comes along and logs in, it appears that the app's logged in user will be unceremoniously logged out, blowing the app out of the water. I didn't try it though.

No worries in this case though because I AM the local machine administrator, but something to keep in mind.


Mike Krausnick
Dublin, California

 

[longhair]

mkrausnick,
thanks for that. i was not reading it that way. it does change the way that it reads. maybe it's just because i don't see xp as an upgrade, more of a lateral move.
regards,
longhair

 

[bcastner]

Thanks all for a very interesting and valuable discussion. One of the reasons I love Tek-Tips is the kind and honest technical discussion that happens. This is one of those moments. Thanks to all.

I will forgive, temporarily, longhair for the suggestion: "... maybe it's just because i don't see xp as an upgrade, more of a lateral move."

Longhair: (I intend this nicely), get over it. Win2k is dead.

While I did not like my first switch to XP, it has over time convinced me that it is the best client software OS Microsoft has written to date. It is not only robust, but feature rich. Tell me about wireless security under Win2k client?

Again, I want to thank all of the contributors to this discussion.

Best wishes,
Bill Castner

 

[longhair]

bcastner,
you are correct about the discussions here. I have learned a lot from many people. some more from others, like youself, who take the time to offer good explanations.
i understand that w2k is on its way out. but when your mrp system is not certified to it yet there isn't much you can do. i do believe that you are correct, in the fact, that once i begin using it i may ver well see it differently.

in regards to wireless security - i'm not a big fan of wireless. i'm not convinced that the os or the hardware are where they need to be yet. i understand that a lot of this fact is due to the user (not changing defaults) but i still think it can be done better.

i'm not really an os person - more of a programmer but know enough to be the backup for our network guru in times of need. if i remember correct, can't you set up a wireless network and have it validate the mac address (this is a hardware solution)? i know this will add work down the road, in terms of maintenance but it is one way to harden the network at the initial install.

we do have a wireless network where i work, but it is for intermec handhelds and never touches a w2k box.

regards,
longhair

 

[bcastner]

Most routers will offer MAC authentication. You are right it is a maintenance chore.

Without starting, unintentionally, a discussion of Wireless Security here, I did find the earlier discussion of Scheduled Tasks quite well done by all.

Thanks to all again.
Bill