Managing Access to Scheduled Tasks and Task Scheduler

The Task Scheduler is used to schedule one-time and recurring tasks that you want to run automatically to perform maintenance or other routine procedures. You can schedule tasks to run on local and remote systems using the Scheduled Tasks Wizard and the Schtasks.exe command-line utility. Once tasks are configured, they can be managed by their creator and anyone with appropriate access permissions, such as domain administrators.

More Info

More Info

To learn techniques for creating and managing scheduled tasks across the enterprise, see the Microsoft Windows Command-Line Administrator’s Pocket Consultant (Microsoft Press, 2004).

In Group Policy, you can manage various aspects of the Tasks Scheduler using either Computer ConfigurationAdministrative TemplatesWindows ComponentsTask Scheduler policies or User ConfigurationAdministrative TemplatesWindows ComponentsTask Scheduler policies. These two policies are identical; you can use them to manage the Task Scheduler at the computer level, the user level, or both—and according to the loopback processing preferences, as discussed in Chapter 3. Again, by default, Computer Configuration settings have precedence over those in User Configuration. If there is a conflict between the computer and user settings, the computer settings win.

The key Task Scheduler policies you can use to help enhance security and ensure maintenance tasks run as expected include:

  • Hide Properties Pages. Prevents all users from viewing or changing the properties of scheduled tasks.

  • Prevent Task Run or End. Prevents all users from manually starting and stopping scheduled tasks.

  • Prohibit Drag-and Drop. Prevents all users from moving and copying scheduled tasks. It also prevents users from dragging and dropping scheduled tasks between folders and systems.

  • Prohibit New Task Creation. Prevents all users from creating new scheduled tasks, whether from the Scheduled Task Wizard or by copying, moving, or dragging. It doesn’t, however, prevent administrators from using the command-line At.exe task scheduler.

  • Prohibit Task Deletion. Prevents all users from deleting existing scheduled tasks. It also prevents users from cutting or dragging a task from the Scheduled Tasks folder.

Note

Note

Administrators whose accounts are affected by the related GPO are also subject to these settings when they are enabled. As a result, these administrators might not be able to modify and work with key aspects of scheduled tasks.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset