Run task scheduler task on demand from limited user account in windows 7

Question

My goal is to for a limited used to be able to run a netsh script that requires administrative privileges:

netsh wlan stop hostednetwork
netsh wlan start hostednetwork

From my administrative account I created a task scheduler task that runs this script with elevated privileges and saved my admin password in it. It worked. But the task is not visible from the limited user account.

I tried creating the same task from the limited user task scheduler - did not happen, it told me the user has no rights to create the task.

Tried schtasks.exe from the limited user, it also does not show the task I want to run.

Is there a way to share the task I created from the administrative account with a limited user so he is able to run it on demand? Or give him privileges to create the task himself?

Answer 1

Go to C:\Windows\System32\Tasks find the related task and assign "read and execute" rights to the user you want to be able to access it. Be sure to assign to "current object only." Then the task will be visible and runnable from the limited user, and it will work if you saved your credentials in it and checked "run whether user is logged on or not."

Answer 2

Yep, that's terrible problem. Chosen answer no longer works. I'm using Event Log as a work around:

1. Register 'on an event' trigger for your task, e.g. "Application", "Application", 30204 (your magic number for this task)

2. Log an event with this id. To do that from commandline / batch, I've wrote dummy 3-line .Net console app.

    using (var eventLog = new EventLog("Application"))
    {
        eventLog.Source = "Application";
        eventLog.WriteEntry("EventLogTriggeer", EventLogEntryType.Information, int.Parse(args[0]));
    }

In my case I've solved security for automated deployments on staging environment. GitHub makes POST request to my node.js backend that runs under IIS AppPool Identity with r/o access to the folder. It verifies hash-signature, and executes:

// delegate to priviledged task
exec('%SystemDrive%\\apps\\EventLogTrigger 30204', (err, stdout, stderr)=> /* ... */);

The remaining part is done via scheduled task that runs deployment script under the user that have permissions to modify files in inetpub. Tasks are individually configured for each server and each website on them, so, the path is hardcoded:

C:\inetpub\ta\autodeploy.cmd