Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

As per the comments in the accepted answer to this question, I'm having issues running a scheduled task which calls shutdown.exe, even when the user is an administrator. I'm administrating someone else's machine using their main account, so I can't exactly change too much as they like things the way that they are.

What's really strange is that I can only make the task run if:

  1. The user is an administrator.
  2. They have defined a password.

For some strange reason unknown to me, not only does a user have to be an administrator, but they also must have a password on the account in order for the scheduled task to run. Otherwise, I get access denied errors and the task fails to run.

How can I make this work without having to force the user to define a password for their account?

Essentially, the remaining goal is to have the computer shut down (no matter who is or is not logged in) at 11pm every night.

I run into the following errors below when I try to set the task in the Scheduled Tasks program:

enter image description here

An error has occurred while attempting to set task account information.
The specific error is:
0x8007005: Access is denied.
You do not have permission to perform the requested operation.

For the record, here's my security policy, you can see that my user has the permission to force shutdown and manually shutdown the computer:

enter image description here

share|improve this question
    
Is the scheduled task running on the machine you want to shut down, or remotely? Have you tried using psshutdown instead of shutdown? –  Harry Johnston Sep 6 '11 at 23:04
    
Locally, haven't tried psshutdown. –  Naftuli Tzvi Kay Sep 6 '11 at 23:05
1  
Windows requires a password for remote desktop and other network administration operations because it'd just be too big of a security hole to have it any other way. On top of that, many people would first blame Microsoft's poor security rather than their own negligence if they were hacked. –  Hand-E-Food Sep 6 '11 at 23:27
    
Hmm. Well, Linux is normally pretty secure, and I can simply sudo crontab -e and add 0 23 * * * shutdown -P now. What could possibly be so hard for an administrator account on Windows to shut down the computer at a given time each day? –  Naftuli Tzvi Kay Sep 6 '11 at 23:29
1  
@grawity: I don't think SYSTEM can hold any rights in the network domain. That just reinforces your conclusion: The Windows NT security model is safer (more robust) precisely because it's harder to gain all rights. Unix root is far too convenient, hence sudo –  MSalters Sep 8 '11 at 13:46
show 2 more comments

3 Answers

up vote 4 down vote accepted

The simplest solution would be to configure said scheduled task to run under an Administrator account. You do not need to use the same account as the usually-logged-on user – simply provide different credentials when creating the task.

If you do not want "Administrator" to have a password, you could just create a dedicated account just for the scheduled task. (A limited User account will work as well, if you apply the fix below.)


The shutdown.exe program needs SeRemoteShutdownPrivilege to run, instead of the usual SeShutdownPrivilege – my guess is that it uses the same RPC for shutting down both local and remote machines. (This would explain the need for a password, too – by default, only console logins are exempt, which obviously does not include RPC.)

You can grant SeRemoteShutdownPrivilege through secpol.mscLocal PoliciesUser Rights Assignment, by editing the "Force shutdown from remote system" entry.

  • You can create a dedicated account for the task and add it here (best choice).
  • For interactive command-line usage by any user, you can add INTERACTIVE.
  • For scheduled tasks by any user, add BATCH.
share|improve this answer
1  
+1: dedicated account for scheduled task. GREAT answer. –  surfasb Sep 6 '11 at 18:09
    
I tried to allow my user to do this by enabling INTERACTIVE, BATCH, and my user for that privilege, and now Windows won't get past the "welcome" screen, it just hangs :( –  Naftuli Tzvi Kay Sep 6 '11 at 20:23
    
@TK: Strange, as the Welcome screen does not use that privilege for anything. Try logging in as another user, or through Safe Mode. If you manage to get in, check Event Log (eventvwr.msc). –  grawity Sep 6 '11 at 21:28
    
I can't get into any account. The welcome screen is displayed and nothing else. I have no visible options. –  Naftuli Tzvi Kay Sep 6 '11 at 21:39
    
@TK: Even in safe mode? Also, try pressing Ctrl+Alt+Del twice on the welcome screen. –  grawity Sep 6 '11 at 21:42
show 3 more comments

I see you are still trying to schedule a task on an admin account without a password.

I'm banking on the fact that the only other setting that has to do with blank passwords is the "Limit local account use of blank passwords to console logon only"

Try that setting. It's under Security options, just underneath user right assignments.

share|improve this answer
add comment

There are some restrictions on creating tasks for accounts with blank passwords.

You can create a task which will run shutdown.exe, but you will need to set the "Do not store password" option. This is on Windows 7 SP1, if you are using a different OS please let us know.

Create Task Window

For Windows XP, use the command line AT tool:

at 23:00 /every:monday,tuesday,wednesday,thursday,friday,saturday,sunday shutdown /s
share|improve this answer
    
On Windows XP, sorry. I just updated the question tags to reflect this. –  Naftuli Tzvi Kay Sep 7 '11 at 4:13
    
Answer updated accordingly. –  Harry Johnston Sep 7 '11 at 8:09
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.