Windows 11 Home: S4U Scheduled Tasks, Batch Logon Rights, and Security Isolation

Hello Windows 11 Community,

I'm developing a security-sensitive application called DataFlow Xpert and would appreciate technical guidance from experienced Windows security engineers or Task Scheduler specialists.

Environment

• Windows 11 Home
• Dedicated local standard user account (proposed)
• Windows Task Scheduler using S4U authentication
• No paid infrastructure or third-party security bypasses
• Disposable, non-production feasibility test only

Objective

I want to determine whether Windows 11 Home can safely support a scheduled process running under a dedicated standard account, with appropriate account isolation, restricted file permissions, and reliable cleanup.

No changes have been made to the system for this experiment. I am seeking technical review before proceeding.

Questions for Windows specialists

1. S4U support on Windows 11 Home: Is TASK_LOGON_S4U officially supported on Windows 11 Home? Has anyone verified this specifically on the Home edition?
2. Batch-logon permissions: When registering an S4U task for a dedicated standard account, does Task Scheduler automatically grant SeBatchLogonRight, or must the right be assigned separately? Does the behavior depend on the registration method?
3. Policy verification: Does secedit /export /mergedpolicy /areas USER_RIGHTS reflect the current effective local security policy? Are LsaEnumerateAccountsWithUserRight and LsaEnumerateAccountRights appropriate independent checks for directly assigned rights?
4. Credential handling: Under what circumstances must an administrator supply the target account's password during S4U registration? Is the password retained after registration?
5. Account expiration and cleanup: If the account expires while a scheduled task is running, what happens to the existing process? Does deleting the task or account automatically remove any associated batch-logon rights?
6. Security isolation: What Windows-supported controls should be evaluated to prevent another standard user from accessing the scheduled process, its private files, or sensitive process memory?

Volunteer technical review

I have prepared a technical evidence summary and an engineering checklist documenting the unresolved Windows behavior and safety requirements.

If an experienced Windows security engineer is willing to provide voluntary technical feedback, I would appreciate a review of these assumptions and recommendations for a safe, reproducible feasibility test.

I am not requesting remote access, paid services, or changes to anyone else's computer. I can share a sanitized technical summary if helpful.

I also posted related questions on Microsoft Q&A:

https://learn.microsoft.com/en-us/answers/questions/6053779/

Thank you for any documentation references, firsthand Windows 11 Home experience, or technical guidance you can provide.