Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 837
  • Last Modified:

Running scheduled task on 2008 R2 domain controller

I've got a scheduled task (DHCPLFR.EXE) that is to roll up dhcp server logs each night.  
It runs on a 2008 R2 domain controller and up until last week it ran fine.  It stopped working as soon as we moved the account it uses out of the domain admin group.

Is there a way to keep the .exe job working without giving the service account it uses domain admin rights?

logs show it completed the job but nothing is actually run.  this is the log output

Task Scheduler successfully completed task "\DHCP Log Backup" , instance "{4352d922-50f2-49f5-bddb-488430928e58}" , action "C:\Windows\System32\dhcp\dhcplfr\DHCPLFR.exe" with return code 3762507597.

Thanks
0
NIS_RULE
Asked:
NIS_RULE
  • 7
  • 6
1 Solution
 
Chris MillardCommented:
If you want to give the task to a non-domain admin account, make sure that the account you wish to use has read access on the folder containing the logs, and write access on the folder where the logs need to be copied to.

Also make sure that the non-domain admin account has the rights to log on locally and log on as a service.
0
 
NIS_RULEAuthor Commented:
The account has full access to the logs folder, however it does not have access to the folder higher up (i.e. c:\windows\system32\dhcp)  for some reason windows won't let me give that account any access to those higher level folders either.
0
 
Chris MillardCommented:
And can you log on to the server as that user ok? If so, can you  click start->run, and type the full path to the log folder and see if Explore will open up in that folder?
0
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

 
NIS_RULEAuthor Commented:
No, the user is a standard domain user, does not have rights to login interactively to that domain controller.
0
 
Chris MillardCommented:
That is probably the reason why. You need to grant the login interactively right to that user account.
0
 
NIS_RULEAuthor Commented:
Our security policy does not allow login interactively for non domain admin accounts on domain controllers.

I have another task scheduled with the same account on the same server except it isn't an .exe (it's a batch file) and it works fine.  

I don't know if there is something special needed for an .exe file to run as scheduled task vs a batch file.
0
 
Chris MillardCommented:
Ah ok. Can you call the exe from within a batch?
0
 
NIS_RULEAuthor Commented:
Tried adding it to a batch file and running the batch file.  get same failure.  :(
0
 
Chris MillardCommented:
Can you move the exe to a non-system directory and run it from there as the non-domain admin user?
0
 
NIS_RULEAuthor Commented:
The exe is only designed to work from that directory.  I would have to track down the developer of the app and have them re-code it if I were to move it  :(
0
 
Chris MillardCommented:
OK - let's try a different approach. DHCP logs are in the format DhcpSrvLog-day.log

I've written a batch file that will copy yesterdays log to a file called DhcpSrvLog-yyyymmdd.log (yesterdays date). This will mean you not having to use the exe.

Save the code below to a batch file (I use the .cmd extension). You'll need to change 'temp\' (line 19) to a location that you want to save the log files to.

Try it out and let me know how it goes.

@echo off
REM Create VBS script

set vbsfile=DateInfo.vbs

echo	Dim dt, yesterday>%vbsfile%
echo	dt = DateAdd("d", -1, Date)>>%vbsfile%
echo	YesterdayDate = Right(Year(dt),4) ^& Right("0" ^& Month(dt),2) ^& Right("0" ^& Day(dt),2)>>%vbsfile%
echo	Newdate = Date>>%vbsfile%
echo	YesterdayNameShort = WeekdayName(DatePart("W",Newdate)-1, True)>>%vbsfile%
echo	wscript.echo YesterdayNameShort^&" "^&YesterdayDate>>%vbsfile%

REM    Store output of vbs script in variables
for /f "tokens=1-2 delims= " %%A in ( ' cscript //nologo %vbsfile% ' ) do (
   set YesterdayNameShort=%%A
   set YesterdayDate=%%B
)

copy %systemroot%\System32\dhcp\DhcpSrvLog-%YesterdayNameShort%.log temp\DhcpSrv-%YesterdayDate%.log

del DateInfo.vbs

Open in new window

0
 
NIS_RULEAuthor Commented:
Thanks for the input.  I found a solution by running the scheduled tasks as system account rather as a service account we created.
0
 
NIS_RULEAuthor Commented:
Found work around
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 7
  • 6
Tackle projects and never again get stuck behind a technical roadblock.
Join Now