Copy folder from network drive via GPO/scheduled task permissions

Question

To install a portable software package, I'm using a scheduled task that runs on user logon to copy a folder from a network share to the local computer using robocopy.

If I'm not mistaken, in order to access the network share, this needs to run under the user context. However, this means the folder created on the local machine is also owned by that user. This allows the user to modify these files on the local machine, which is what I want to avoid. Ideally, I want to folder to be only readable/writeable by SYSTEM.

How can this be achieved?

Answer 1

You could grant the machine account of the workstation (DOMAIN\HOSTNAME$) or the Domain Computers group access to the network share. Then you would be able to run the script as SYSTEM.