TSK: Task Scheduler Group Policies

First published on TECHNET on Apr 13, 2009

TASK SCHEDULER GROUP POLICIES

Description: Task Scheduler is automatically installed with the Microsoft® Windows® Server 2003 family, Windows XP, and Windows 2000 operating systems and is started each time the operating system is started. It can be run through the Task Scheduler graphical user interface or the AT.EXE command.

With the Task Scheduler you can:

• Create tasks.


• Schedule a task to run at a specific time or when a specific event occurs.


• Change the schedule for a task.


• Customize how tasks run.


• Stop a scheduled task.

There are Group Policies that can be set to control several aspects of Task Scheduler functionality. There are 7 Group Policies located under each of the following locations:

Computer Configuration > Administrative Templates

User Configuration > Administrative Templates

The Policies include:

• Hide Property Pages


• Prevent Task Run or End


• Prohibit Drag and Drop


• Prohibit New Task Creation


• Prohibit Task Deletion


• Hide Advanced Properties Checkbox in Add Scheduled Task Wizard


• Prohibit Browse

Task Scheduler requires the following effective permissions for the user credentials that are being used to launch the task:

Computer Configuration > Windows Settings · Log on as batch job

Scoping the Issue: There are a few things to ask when dealing with Group Policies for Task Scheduler:

1. 
   
   What is the goal to use Task Scheduler policy?


2. 
   
   What Group policy do you want to set?


3. 
   
   What is the client Operating System and Service Pack level?


4. 
   
   What is the functional level of the Domain?


5. 
   
   What is the Operating System on the Domain Controller?.

Data Gathering: In all instances, collecting either MPS Reports with the General, Internet and Networking, Business Networks and Server Components diagnostics, or a Performance-oriented MSDT manifest must be done.  In addition, capture a GPRESULT log from the client:

• Windows XP and later Operating Systems: GPRESULT /Z > results.txt


• Windows 2000: GPRESULT /S > results.txt

Additional Resources:

• MSDN: Task Scheduler Best Practices


• MSDN: Task Scheduler Overview


• Microsoft KB Article 305612: How to prevent a user from running Task Scheduler in Windows


• Microsoft KB Article 314970: HOW TO: Prevent Users from Changing Scheduled Tasks in Windows 2000


• Microsoft KB Article 278295: How to lock down a Windows Server 2003 or Windows 2000 Terminal Server session