Windows – How to allow non-administrators to use shutdown.exe

windowswindows task schedulerwindows xp

As per the comments in the accepted answer to this question, I'm having issues running a scheduled task which calls shutdown.exe, even when the user is an administrator. I'm administrating someone else's machine using their main account, so I can't exactly change too much as they like things the way that they are.

What's really strange is that I can only make the task run if:

The user is an administrator.
They have defined a password.

For some strange reason unknown to me, not only does a user have to be an administrator, but they also must have a password on the account in order for the scheduled task to run. Otherwise, I get access denied errors and the task fails to run.

How can I make this work without having to force the user to define a password for their account?

Essentially, the remaining goal is to have the computer shut down (no matter who is or is not logged in) at 11pm every night.

I run into the following errors below when I try to set the task in the Scheduled Tasks program:

enter image description here

An error has occurred while attempting to set task account information.
The specific error is:
0x8007005: Access is denied.
You do not have permission to perform the requested operation.

For the record, here's my security policy, you can see that my user has the permission to force shutdown and manually shutdown the computer:

enter image description here

Best Answer

The simplest solution would be to configure said scheduled task to run under an Administrator account. You do not need to use the same account as the usually-logged-on user – simply provide different credentials when creating the task.

If you do not want "Administrator" to have a password, you could just create a dedicated account just for the scheduled task. (A limited User account will work as well, if you apply the fix below.)

The shutdown.exe program needs SeRemoteShutdownPrivilege to run, instead of the usual SeShutdownPrivilege – my guess is that it uses the same RPC for shutting down both local and remote machines. (This would explain the need for a password, too – by default, only console logins are exempt, which obviously does not include RPC.)

You can grant SeRemoteShutdownPrivilege through secpol.msc → Local Policies → User Rights Assignment, by editing the "Force shutdown from remote system" entry.

You can create a dedicated account for the task and add it here (best choice).
For interactive command-line usage by any user, you can add INTERACTIVE.
For scheduled tasks by any user, add BATCH.

Related Solutions

Windows – Run interactive task even if user is not logged on Windows

I would use Autologon from Sysinternals to autologon, but add a scheduled task with a trigger (start at login) and enter this command in the task scheduler

Program: rundll32.exe and as parameters: user32.dll,LockWorkStation

and create the task. The rundll32 command locks the PC after the automatic logon. So you get your task running but the PC will be locked.

Windows – How to fix broken permissions for Windows scheduled task

All tasks definitions stored in both

Registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\*

and

Filesystem: C:\Windows\System32\Tasks\*

Security Descriptors exists both on files in filesystem and stored in the registry for each task:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\<TaskName>\SD

This registry value is in the binary form and it seems that there is no decent UI for it.

You could get retrive it via Powershell and Task Scheduler API (https://docs.microsoft.com/en-us/windows/win32/api/_taskschd/index):
```
$ts = New-Object -ComObject "Schedule.Service"
$ts.Connect("localhost")
$task = $ts.GetFolder("").GetTask("<TaskName>")
Write-Host $task.GetSecurityDescriptor(0xF)
```
- This method return security descriptor in SDDL format

BUT:

I've got into the same problem and it seems that the problem is not directly related to task permissions, but to hardlinks on tasks created during Windows 10 upgrade
- Check folder C:\$WINDOWS.~BT\NewOS\Windows\System32\Tasks_Migrated\ whether it contains hardlinks to task's files in C:\Windows\System32\Tasks
- I've removed all hardlinks from C:\$WINDOWS.~BT\NewOS\Windows\System32\Tasks_Migrated\ and after that Unregister-ScheduledTask work as expected.

UPDATE:

I've finally investigated a problem with "broken" tasks permissions in Windows 10. It has nothing common with permissions at all and looks like an unexpected outcome of security patch.

11/06/2019 Microsoft released a patch for CVE-2019-1069. This patch fixed a vulnerability of the Task Scheduler and to exploit it an adversary need to create a hardlink to a file associated with some task.

If this patch installed you can't change/enable/disable/delete Task with Task Scheduler API (schtasks, powershell -ScheduledTask, COM "Schedule.Service") if associated task file in C:\Windows\System32\Tasks\ have any hardlink.
Windows Feature update during installation do "Tasks migration" procedure and create hardlinks to all tasks in the folder C:\$WINDOWS.~BT\NewOS\Windows\System32\Tasks_Migrated\ and this could be a reason why tasks cannot be deleted.
Deleting all hardlinks solves the problem.

Best Answer

Related Solutions

Windows – Run interactive task even if user is not logged on Windows

Windows – How to fix broken permissions for Windows scheduled task

Related Question