G
Guest
Hi, I want use schtasks.exe to interactively enable/disable a task that
executes at logoff (when run from a script file which will supply the yes/no
user prompt). The trouble I'm having is that the task I created in Task
Scheduler (named SleepAfterLogof) doesn't show up when I run schtasks.exe
/query at the command prompt.
The xml for the task (produced by the Export command in Task Schedular) is
pasted below. The purpose of the task is to automatically sleep the computer
after logoff. Note that the task is triggered by a specific system log event
(ID# 4647) and executes a script (which executes a program that tells the
computer to go to sleep). Also note that the task is set to run from the
SYSTEM account with highest priveledges (because the task has to keep
executing after I logoff).
Two interesting things to note: First, if I change the account under which
the task should run from SYSTEM to my own (which is in the admin group), I
get two errors when I run schtasks /query
ERROR: Task cannot be loaded: SleepAfterLogoff
ERROR: Access is denied.
Second: if I run schtasks in an elevated command prompt, the task
(SleepAfterLogoff) does appear and I can enable and disable it.
This looks like a security issue. There are a number of ways to think about
possible solutions, but basically I want to be able to enable/disable the
SleepAfterLogoff task using schtasks.exe from my account without resorting to
elevated priviledges (and without turning UAC off). There should be some way
(I hope) to tell the system that my account can have full access to the task.
Do tasks have ACL's? If so, can they be edited (i.e. as for files)? Thanks
in advance for help with this.
Clay
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2"
xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo>
<Date>2007-08-03T07:15:49.3280055</Date>
<Author>Drosera\Clay</Author>
<Description>Put the computer to sleep immediately after
logoff</Description>
</RegistrationInfo>
<Triggers>
<EventTrigger id="4057a03f-71f8-40ac-a708-90d1712d98c5">
<Enabled>true</Enabled>
<Subscription><QueryList><Query Id="0" Path="Security"><Select
Path="Security">*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4647]]</Select></Query></QueryList></Subscription>
</EventTrigger>
</Triggers>
<Principals>
<Principal id="Author">
<UserId>SYSTEM</UserId>
<RunLevel>HighestAvailable</RunLevel>
</Principal>
</Principals>
<Settings>
<IdleSettings>
<Duration>PT10M</Duration>
<WaitTimeout>PT1H</WaitTimeout>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>true</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<WakeToRun>false</WakeToRun>
<ExecutionTimeLimit>P3D</ExecutionTimeLimit>
<Priority>7</Priority>
</Settings>
<Actions Context="Author">
<Exec>
<Command>"E:\Development\Windows Script Host\Scripts\Run Drosera from
Trillium\Sleep Drosera.vbs"</Command>
</Exec>
</Actions>
</Task>
executes at logoff (when run from a script file which will supply the yes/no
user prompt). The trouble I'm having is that the task I created in Task
Scheduler (named SleepAfterLogof) doesn't show up when I run schtasks.exe
/query at the command prompt.
The xml for the task (produced by the Export command in Task Schedular) is
pasted below. The purpose of the task is to automatically sleep the computer
after logoff. Note that the task is triggered by a specific system log event
(ID# 4647) and executes a script (which executes a program that tells the
computer to go to sleep). Also note that the task is set to run from the
SYSTEM account with highest priveledges (because the task has to keep
executing after I logoff).
Two interesting things to note: First, if I change the account under which
the task should run from SYSTEM to my own (which is in the admin group), I
get two errors when I run schtasks /query
ERROR: Task cannot be loaded: SleepAfterLogoff
ERROR: Access is denied.
Second: if I run schtasks in an elevated command prompt, the task
(SleepAfterLogoff) does appear and I can enable and disable it.
This looks like a security issue. There are a number of ways to think about
possible solutions, but basically I want to be able to enable/disable the
SleepAfterLogoff task using schtasks.exe from my account without resorting to
elevated priviledges (and without turning UAC off). There should be some way
(I hope) to tell the system that my account can have full access to the task.
Do tasks have ACL's? If so, can they be edited (i.e. as for files)? Thanks
in advance for help with this.
Clay
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2"
xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo>
<Date>2007-08-03T07:15:49.3280055</Date>
<Author>Drosera\Clay</Author>
<Description>Put the computer to sleep immediately after
logoff</Description>
</RegistrationInfo>
<Triggers>
<EventTrigger id="4057a03f-71f8-40ac-a708-90d1712d98c5">
<Enabled>true</Enabled>
<Subscription><QueryList><Query Id="0" Path="Security"><Select
Path="Security">*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4647]]</Select></Query></QueryList></Subscription>
</EventTrigger>
</Triggers>
<Principals>
<Principal id="Author">
<UserId>SYSTEM</UserId>
<RunLevel>HighestAvailable</RunLevel>
</Principal>
</Principals>
<Settings>
<IdleSettings>
<Duration>PT10M</Duration>
<WaitTimeout>PT1H</WaitTimeout>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>true</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<WakeToRun>false</WakeToRun>
<ExecutionTimeLimit>P3D</ExecutionTimeLimit>
<Priority>7</Priority>
</Settings>
<Actions Context="Author">
<Exec>
<Command>"E:\Development\Windows Script Host\Scripts\Run Drosera from
Trillium\Sleep Drosera.vbs"</Command>
</Exec>
</Actions>
</Task>