Hi,

OS: Windows 2008 Server 64bit
I want to run tasks in background mode but I get an error "Logon failure: the user has not been granted requested logon type at this computer".

The error does not happen if I specify the administrator credentials in the task, but does happen under the user who actually needs to run it.

That user already has "logon as a batch job" permission. Can you tell me what other permissions are required.

Thanks.

Not sure what your Task is trying to do. If it is trying to access a network share or similar.

I did a quick search on Google on that specific error message:

http://forums.techguy.or...d-user-has-not-been.html 

---

Every single task has this issue. For example we can create a task which simple runs the command shell (cmd). If we run this task without any credentials, it works fine.

However once we change it to run as a specific user, we get this error. If we add this specific user to the administrators group on the server, the error goes away. However due to security policies, we can't have this user in the administrators group.

The tasks are set to run as background execution.

I had a look at the log files, but they didn't have anything useful, simple the error as we reported.

Let me know if we can run anything on the server to give you more information,

We seem to be able to run tasks as this user using Windows Task Scheduler, however not using Visual Cron.

Thanks
Jeremy

Hi,

When we set "Network Credentials Only", the problem seems to go away. Using logon with profile causes the error to occur.

According to the security logs, the logon is happening successfully. Do you have any other test code we could try (sample .net code would be great) which performs the exact same logon process which is done when executing a job? We can then test this outside of visual cron.

Thanks
Jeremy

Network Credentials Only is the correct way if the Credential is there to access a network share.

---

We need to have the profile available for our jobs to run successfully.

Could you let me know what the difference is with this option to simply having Network Credentials only?

The difference is that With profile loads the current profile. However, if the Credential that you use is on/from another server that will not work - then you need to use Network credentials option.

With profile and network access is only possible if you are using a domain user. That should both load a user and add network access.

---

Hi,

The user we are using is a domain user. We've done some further investigation and we can successfully run Visual Cron jobs as this domain user on one PC, however not on another server. However at this stage we are unable to find any difference in the security settings between the two machines. On the server which doesn't work, we can get it to work only by adding the user in the Administrators group. However this is not an acceptable solution.

When we examine the security log on the machine we don't see any errors. We see the user successfully logon. But the job still doesn't get started by Visual Cron.

Windows Task Scheduler is able to run jobs using this domain user with no issues. So there is some difference in how VCron is starting jobs and how Task Scheduler is.

I believe there is some issue with the security settings on this machine or the domain. Are you able to tell me what underlying API is being called to perform this logon so I can do further debugging?

I'm happy to give you a call to discuss this if I have confused you.

The underlying API for this is CreateProcessWithLogonW.

This should work by default on a new OS install. It seems that your OS is limited in security settings some way but it is very hard to see in what way.

The ordinary Task scheduler has some deeper integrations because it is built into Windows but the end result should be the same.

---

I've created an application that uses this particular API. However it seems to work fine and is able to start the cmd process with the domain user, however Visual Cron can't.

I've attached the program I've written for reference.

Is there any other options that you are passing to the API call that are different to mine?

Is it possible to enable extra debugging in Visual cron? My guess is that the logon is successful but some other API call then fails. The Job History in VCron shows the exit code is -1073741 which doesn't look like a windows error code.

According to the documentation, CreateProcessWithLogonW can't be called from within a process which is running as Local System. How do you call it from Visual Cron? If I call it from within an application which has been started by a Visual Cron task I get a ERROR_ACCESS_DENIED.

According to the documentation, CreateProcessWithLogonW can't be called from within a process which is running as Local System. How do you call it from Visual Cron? If I call it from within an application which has been started by a Visual Cron task I get a ERROR_ACCESS_DENIED.

This can be done, without adding too many details, by opening the WindowStation (desktop) first.

While it would be great to know exactly what is stopping VisualCron from doing this it might also be very hard to find. Almost easier to use VisualCron on a new server.

Please send some screenshots of your settings in the Execute Task for the non-working machine.

---

Thanks for your responses so far. Our system admin team have been trying to check what the issue is by comparing to an install on another server.

They have asked whether you could confirm you support Windows 2008 R2?

Thanks in advance,
Jeremy

Yes, we support Windows 2008 R2.

---