I’m running Windows 10, and trying to get a pair of scheduled tasks working. These tasks are set to run on workstation lock and workstation unlock, and execute a script that remotely locks or unlocks an adjacent arch-linux workstation. This is accomplished via the WinSCP command-line interface, WinSCP.com, and its built-in scripting ability. These scrips are working just fine – I can invoke them manually to the desired effect. I can even right-click the tasks I’ve set up and click ‘run’, and observe the desired effect. The problem is that the workstation-lock and workstation-unlock events don’t appear to ever be triggered, when actually locking and unlocking the workstation. This same set of scheduled tasks worked as expected under Windows 7.
Based on answers so far, I can get the tasks to run as expected if I check the “Run only when user is logged on” box, but this has the undesired side effect of causing a visible command window to appear when the tasks are triggered.
OS is Windows 10 Enterprise LTSB 2016 (x64). Any insight or ideas would be appreciated.
Things I have already tried:
Using GPO to enable auditing of workstation lock/unlock events – no effect. (lock/unlock events appear in the event viewer as expected)
Creating an alternate windows user and setting the task to run as that principal.
Wrapping the call to WinSCP.com in a batch script.
Modifying local GPO to ensure that logon-as-batch is enabled.
Other relevant information: Other scheduled tasks (e.g. those running at a set time or interval) are working fine. Only these two tasks are failing to trigger.
Edit: Per Twisty’s comment, I turned on task history, and got an actual error message:
So it appears the task is indeed triggered, but fails to launch. Interestingly, this does not update the “Last Run Time” property for the task.
Some cursory googling indicates that this error may be related to logon/password information. I’ve verified that the stored password is correct, but the same issue persists. Here is a screenshot of the ‘General’ tab as requested.
Here is the WINSCP script being executed (key censored):
# Connectopen sftp://charles@192.168.0.1:2222/ -hostkey="ssh-rsa 2048 xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx"call cinnamon-screensaver-command -dcloseexitI’ve just tried wrapping this in a very simple batch file:
@ECHO ONSET prgwinscp="C:Program Files (x86)WinSCPWinSCP.com"%prgwinscp% /script=lock-arch.winscpI can execute this by hand, and as a scheduled task it works when I check “Run only when user is logged on”. Unfortunately, as before, once I set the task to “Run whether user is logged on or not”, I get the usual failure.
As requested, here is a screenshot of the actions tab:
The obscured text is as follows:
Add Arguments (Optional): /script=unlock-arch.winscpStart in (Optional): C:Program Files (x86)WinSCP
Solution:
Follow the below steps to troubleshoot and resolve your problem
Task Scheduler Properties. . .
From Windows Task Scheduler on the job properties (see bottom most screen shots) in the. . .
1. General tab, ensure that the below options are select/checked or unchecked just as shown in Print Screen A
- Uncheck
Run only when user is logged on - Check
Run whether user is logged on or not - Check
Run with the highest privileges
- Uncheck
2. Conditions tab, ensure that the below options are select, checked, or unchecked just as shown in Print Screen B
- Check
Wake the computer to run this task
- Check
3. Actions tab, click Edit, and enure that the
Start in (optional)is set just as shown in the below example (DO NOT put double quote marks around it) for the full path pointing where the batch script is located WITHOUT a final backslash “” Print Screen C
SECURITY CONSIDERATIONS
Once you press OK (2. above) it should prompt you for the credential to run this as, and that credential is what will need access to
EXECUTEthe batch file where it exist, and it will also need access to do whatever the batch file is running that you scripted out.It may be best to setup a static service/proxy user account for this process and then use its credentials to run the process. You’d need to ensure its password is strong and it set to never expire—and it needs access to
EXECUTEthe batch and run whatever the batch scripted process is running and any commands and resources, ect. it utilizes as well.It seems the option
Run whether user is logged on or notyou MUSTcheck the optionRun with highest privilegesfor it to actuallyrun as expected from the Task Scheduler.
Error Checking
If there is an issue with the actual batch script but the Windows TaskScheduler actually does execute it to run it but the batch scriptlogic errors out, etc. for whatever reason, the Task Scheduler maynot see this failure at this level. From its perspective (by default most of the time), it’sexecuting the batch file so as long as it can execute it and hasaccess to do so, its job is done successfully.
Add error checking or logging to the batch script logic to catch (or troubleshoot) issues at this level including ensuring that the security context which the batch scheduler executes it as has appropriate access to commands, resources, etc. which the batch script runs as.
Group Policy Considerations
CHECK GROUP POLICY AND LOG ON AS A BATCH JOB PERMISSIONS
Answer: On Windows, this privilege is granted through the Local or Domain Security Policy. To do this using the Local Security Policy, follow these steps.
- In the Control Panel, open Administrative Tools, then Local Security Policy.
- Beneath Security Settings, open Local Policies and highlight User Rights Assignment.
- Locate Log on as a batch job. Open the properties and add any users that need this right.
- When finished, save your changes and close the Local Security Settings window.
Your changes should take effect immediately. To make changes to the Domain Security Policy, on a domain controller, use the Domain Security Policy utility in the Control Panel
Batch Script Logic with Mapped Drives or Full UNC Path, and issues. . .
If your script is referencing a mapped network drive but you want it to Run whether the user is logged on or not, then under this context, the drive mapping may not actually be there for the batch process to do what’s expected.
If possible, use UNC paths in your batch script logic rather than a mapped drive letter to avoid issues. Otherwise, you may need to use PUSHD \ServerNameShareName at the beginning of the batch process and then use POPD at the end of the batch process. You could map the drive with NET USE X: \ServerNameShareName at the beginning of the batch process and then disconnect the drive with NET USE X: /DELETE at the end of the batch process.
Print Screens
Print Screen A
Print Screen B
Print Screen C
WinSCP Batch Script Examples
Below are two very basic and dumbed-down examples of an FTP script to upload to and an FTP script to download from an FTP server using WinSCP.com. Be sure the SET winscplogin= variable is set to the name of the FTP connection you have defined from within the WinSCP GUI.
This way builds the script dynamically and you build the FTP commands from within the batch script but you can also just simply point it to a static WinSCP script with the FTP commands in them otherwise too which is easy to setup.
Upload to an FTP Server
@ECHO ONSET logfile=C:folderpathlog.log::SET WinSCP variables, etc.SET prgwinscp="C:Program FilesWinSCP3WinSCP.com"SET winscplogin="ABC Company"SET winscpfile=C:folderpathABCompany_FTP_OUT_WinSCP.txtIF EXIST "%winscpfile%" DEL /Q /F "%winscpfile%":ftpoutECHO. >> "%logfile%"ECHO *******************FTP OUT******************* >> "%logfile%"ECHO Delivering file(s) to ABC Company FTP server >> "%logfile%"SET ftpdir="ToABC"ECHO option batch on >> %winscpfile%ECHO option confirm off >> %winscpfile%ECHO option transfer binary >> %winscpfile%ECHO open %winscplogin% >> %winscpfile%ECHO cd %ftpdir% >> %winscpfile%ECHO put "C:FolderPath*.*" >> %winscpfile%ECHO dir >> %winscpfile%ECHO close >> %winscpfile%ECHO exit >> %winscpfile%ECHO %winscpfile% >> "%logfile%"TYPE %winscpfile% >> "%logfile%"ECHO - - - - - - - - - - - - - - - - - - - - - - >> "%logfile%"%prgwinscp% /script=%winscpfile% >> "%logfile%"ECHO - - - - - - - - - - - - - - - - - - - - - - >> "%logfile%"IF EXIST "%winscpfile%" DEL /Q /F "%winscpfile%"ECHO Transmission complete >> "%logfile%"Download from an FTP Server
@ECHO ONSET logfile=C:folderpathlog.log::SET WinSCP variables, etc.SET prgwinscp="C:Program FilesWinSCP3WinSCP.com"SET winscplogin="ABC Company"SET winscpfile=C:folderpathABCompany_FTP_IN_WinSCP.txtIF EXIST "%winscpfile%" DEL /Q /F "%winscpfile%":ftpinECHO. >> %logfile%ECHO *******************FTP IN******************* >> %logfile%ECHO Retrieving files from ABC Company server >> %logfile%SET ftpdir="FromABC"ECHO option batch on >> %winscpfile%ECHO option confirm off >> %winscpfile%ECHO option transfer binary >> %winscpfile%ECHO open %winscplogin% >> %winscpfile%ECHO cd %ftpdir% >> %winscpfile%ECHO ls >> %winscpfile%ECHO get "*.*" "C:Folderpath" >> %winscpfile%ECHO close >> %winscpfile%ECHO exit >> %winscpfile%ECHO %winscpfile% >> %logfile%TYPE %winscpfile% >> %logfile%ECHO ------------------------------------------- >> %logfile%%prgwinscp% /script=%winscpfile% >> %logfile%ECHO ------------------------------------------- >> %logfile%IF EXIST ""%winscpfile%"" DEL /Q /F ""%winscpfile%""ECHO FTP Downloading Complete >> %logfile%ECHO Transmission complete >> %logfile%Custom Example Scripts
Be sure to use both the options of Run whether user is logged on or not and Run with the highest privileges when you schedule the batch script. Once you apply these changes you will need to put in credentials to run the task as explicitly. Be sure to use an account that has execute access to the C:Program Files (x86)WinSCPWinSCP.com file and that also meets the other general prerequisites as listed above.
If you still have issues and want to confirm it’s not OS security related