Hi,

Just downloaded a trial version of version 8.5.0.

I have created a simple job with a Execute task, that starts a bat file using a domain user.
The credentials is created using default settings (its a domain user).
The task execute the command "C:\Temp\b.bat" which contains the line "whoami >> a.txt".
The result is the following message:



I have enabled extending debugging and tried to change the credentials, but I have not disabled the UAC (it's not an option to do that).
Nothing seems to change anything.

I have then started two command windows, one as myself and one using the credentials also added to VisualCron.
Executing the bat file works with both users.

Any suggestions?

Thanks.

Error: Exit code -1073741502

There is a permissions problem, either on user level (the Credential you use) or the Local Security Policy settings on the server that prevents the SYSTEM account from running a process as another user. While the problem might be unknown there are some alternatives and workarounds:



Alternative 1

Make sure that the serviceuser account is a local administrator.



Alternative 2

If you use 8.1.2 or later:

1. Turn on Extended debugging in Server settings.

2. Edit the Credential that you use

3. Change Execution options to Use Win32 API CreateProcessAsUser



Workaround 1

Turn of UAC in the Server settings in VisualCron window and reboot

---

There are a few things to consider, I understand that, but at first I would like to understand why it works when fired though a command prompt started by me, but not when started by VisualCron. Also it is working on a older setup, 2008R2 server, visualcron version 8.0.2..
This server (where the issue exists) is version 2016 with visualcron 8.5.0.
Both servers run in the same domain and I am using the same domain user on both setups.

Thanks.

Because when you execute normally you are executing as your user. But in VisualCron two things occur;

1. the SYSTEM user is starting a process as 2. the selected user. Because of this the SYSTEM account needs to have the permissions to start a process as another user which means member of local Administrators group.

---

OK, that make sense, except from...
What do you mean about SYSTEM account, is it SYSTEM as in VisualCron-system, or OS-system?
I see there is a AD server property under Server-Settings, Users/Logon - I have tried to add a domain user here with local admin rights, but it did'n change anything.

Thanks.

OK, that make sense, except from...
What do you mean about SYSTEM account, is it SYSTEM as in VisualCron-system, or OS-system?
I see there is a AD server property under Server-Settings, Users/Logon - I have tried to add a domain user here with local admin rights, but it did'n change anything.

Thanks.

The SYSTEM account that runs the VIsualCron Windows service. AD-properties you are talking about is for accessing the VisualCron Server from a Client.

---

Hi.
Can you explain the difference between the excution options Win32 API CreateProcessAsUser and Win32 API CreateProcessWithLogonW?
Thanks!

These are just two different methods for executing a process. We investigated alternative methods to come around various problems but the main recommendation is to keep it at default CreateProcessWithLogonW.

While CreateProcessWithLogonW *could* be a workaround one problem with CreateProcessAsUser is that it cannot access network shares - even though you use a Credential.

The problem with -1073741502 is permissions on either the user that executes or the host user (the user that runs the VisualCron service). In general it is lacking admin rights (not member of administrators group). Which exact permissions we do not know but we know that this is not an issue on a new install of Windows.

Turning of UAC is another broad method of making it work. But it has do be done right which we ensure by turning it off in Server settings of VC. And then reboot.

---