Scheduled task running as SYSTEM - execute something as current user?

Question

I have a scheduled task which runs a batch file which does some stuff. I want the batch file to kick off another batch file which runs in user space; i.e. %username% == the currently logged-in user, with user permissions, etc. How can I run a command under the current user, given that the scheduled task runs with SYSTEM permissions?

I need this for both Windows XP and Windows 7.

Answer 1

Ever since the introduction of Terminal Services, "current user" can be plural. Even XP supports fast user switching.

The closest you can get is "user connected to the console session". For this, use WTSGetActiveConsoleSessionId() + WTSQueryUserToken() + CreateEnvironmentBlock() + CreateProcessAsUser().

---

I wrote this: https://gist.github.com/871048 – Compile, run with full path to your batch file as arguments.

Yes, this requires .NET Runtime, but it's likely that your systems already have it. The compiler's part of the Runtime, too: %SystemRoot%\Microsoft.NET\Framework64\v3.5\csc.exe (any version starting with v2.* will work).

Note: WTSQueryUserToken() requires the program to be running as LocalSystem. (According to the docs, SeTcbPrivilege is not enough, but I haven't checked.)

Answer 2

Under "When Running Task, use the following user account:" you can set it to "BUILTIN\Users" group, it will run the task as the current logged in user.

Answer 3

I don't think you can set it through the task scheduler tool to dynamically use the current logged in user, but you can specify a user account to use besides System in the task itself. Both of the below options will require that you have the password for the username.

Windows 7: In the properties window for the task, there is a button in Security Options called "Change User or Group".

Windows XP: In the properties window for the task, you can enter a username in the "Run As" field.

One final option may be to create a startup script that will create the task when the user logs on, and a companion logoff script to delete it when they log off. The command is "Schtasks", which is nearly identical in XP and 7. Documentation for the command is available from MS at the following site: http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/schtasks.mspx?mfr=true