1
We have 20 + build machines which are running windows 7 enterprise managed by Microsoft SCCM.
As a company wide policy, "logon as batch" has been disabled for the users on client PC's. This means the scheduled tasks aren't running.
I can change the policy but when next run of SCCM it is resetting back.
we have a handful if scheduled tasks which need to run on the build machines.
Are there any alternatives for to execute the scripts on
- Scheduled timings
- During restart
thanks.
KK99
Posted 2017-08-25T07:52:25.683
Reputation: 141
Have you access to a Server? You can run the scripts over the systeminternals PSExec. Performing from a scheduled Task on the mentioned Server. – Simon Zorn – 2017-08-25T11:25:29.433
well those are dekstop running Windows 7. Yes I have access. How to schedule the PSExec? – KK99 – 2017-08-25T12:34:56.987
If you need the user that logs onto the machine to have these run under their security context, then I suppose running as a logon script rather than a scheduled task would suffice so consider that. Otherwise, if you need to run as scheduled times and not necessarily as the actual user, the consider scheduling to run as a different security context rather than that of the user that logs onto the machine. What are these tasks doing exactly and do they need to run of the user security context that actually uses these machine. – Pimp Juice IT – 2017-08-25T14:46:02.120
Also consider using SCHTASKS and something like
%schtasks% /Create /S %machine% /U %user% /P %userPwd% /RU %executeAs% /RP %executeAsPwd% /SC ONCE /TN "Cleanup" /TR %file% /ST 00:00:00 /F /RL HIGHESTand after than followed by%schtasks% /Run /S %machine% /U %user% /P %userPwd% /TN "Cleanup"replace the variables accordingly for your environment obviously... I've done this many times and it works just fine assuming the machines have correct FW ports opened to allow such traffic i.e. open up Remote Administration in Windows FW or applicable TCP ports—maybe RPC but don't remember exactly. – Pimp Juice IT – 2017-08-25T14:48:27.630Check out schtasks here — I like that Thundercats logo there too by the way.... Thundercats, thundercats, thundercats..... Hooooo!!!
– Pimp Juice IT – 2017-08-25T14:50:37.540I believe this works when "logon as batch" as enabled. This doesn't work when "logon as batch" is disabled for user. This is my issue here. – KK99 – 2017-08-25T14:50:46.207
So run the task and DO NOT have it run as that user—run it as a different credential. What is the task supposed to do anyway? Forget about the scheduling of it, what is it and does it have to run as that user or do you just need it to run on each machine a user uses regardless? – Pimp Juice IT – 2017-08-25T14:52:14.067
The commands I gave you above in my example is what I've run remotely on the same network to run a task with Task Scheduler from a different machine as for example domain administrator but it still runs on the machine under that security context based on it being allowed the run as batch security context. If you have the ports and/or FW opened as I suggested, and use a different security context such as domain admin or a domain admin, it may work just fine. Just giving you some pointers, ideas, and things to try, etc. in case you can test and confirm it something like that would work. – Pimp Juice IT – 2017-08-25T14:55:14.157
@McDonald's The scheduled Tasks (different ones) are supposed to start some Java applications, scheduled reboot etc. These scheduled Tasks run with a specific user account and run with "Highest privileges". All was fine until the update of our "group policy" via SCCM. After this these schedule tasks won't run (our applications run though ). – KK99 – 2017-08-25T15:03:37.077
If you need to start an app for a user at login, look at dropping a script or a shortcut to the app with arguments, etc. in the local
/startupfolder on the machine—or a login script that does not need . If you need to reboot the machine, this does not need the login as batch permission. For the reboot, you do not need to run this as the user, run it as a different security context instead that does have this permission. You can also run remote command from another location such asshutdown /r /f /m \\computername /t 01to remotely restart a machine – Pimp Juice IT – 2017-08-25T15:14:43.673well here is the point. These are machines which are scheduled to reboot at certain time (sunday) and once restarted it need to start some of our applications. We don't want to do remotely as this requires my / team presence all the time. Point is after this permission been removed, my tasks which are scheduled aren't running and I am trying to find some alternatives. – KK99 – 2017-08-25T15:18:13.850