3

I have an odd problem that has started happening with Task Scheduler on Windows Server 2012 R2.

A bunch of scheduled tasks all have this same problem. I checked on it a few weeks ago and it was fine, but now it has started happening on several boxes.

When the scheduled task is run, it has one action: start a program. This program is a batch file (with a .CMD extension, but I've tried with a .BAT extension; same problem). The task runs fine, but when the task is run, the file is usually (like 90% of the time) deleted! Well, actually, it's more like "shadow-deleted" because afterwards, a file of the same name cannot be written to the directory the .BAT/.CMD file was in ("destination folder access denied" even with Admin permissions) until the machine is rebooted. It looks like the file is still there in some memory cache, but it doesn't appear in Windows Explorer and cannot be found on the commandline.

This happens whether the task is triggered automatically via a time schedule, or triggered manually.

I can understand the possibility of the task failing to run because of a permissions error (although it was working fine a few weeks ago and the task does run successfully the one time before the file has been shadow-deleted!), but why on earth would it shadow-delete the batch file?

I found one other instance of someone having a similar problem, but they fixed it by recreating the tasks: https://answers.microsoft.com/en-us/windows/forum/windows_7-performance/windows-7-bug-task-scheduler-deleting-task-bat/33ecfb3e-d22e-4c1b-bc71-076391bcd1ba

I tried that but still get the same problem.

Jez
  • 1,333
  • 2
  • 11
  • 23
  • 1
    Do you have any anti-virus software running? I had a problem when I forgot to whitelist these files, they were deleted – Lenniey Apr 05 '17 at 10:05
  • @Lenniey Very good idea - Avast is running on there. I wonder whether it is doing it. I guess I'll ask infrastructure to take a look. However, if I run the file manually from the commandline it doesn't get deleted so I'm not sure why Avast would delete it only when Task Scheduler runs it? – Jez Apr 05 '17 at 10:08
  • Maybe because it is being run by some different account which is not whitelisted to do so? I don't know your server / services, just guessing – Lenniey Apr 05 '17 at 10:14

1 Answers1

5

It turned out to be Avast detecting the scripts as viruses and deleting them. It had to be configured to allow the .CMD files to be run by Task Scheduler.

Jez
  • 1,333
  • 2
  • 11
  • 23