Windows administrator rights

Question

Windows administrator rights

MCK_De 21

Hello,

At the moment I am trying to set up an automatic backup to save my data on a Win 10 computer with Novabackup. At the end of each backup job, a PostScript should be executed, which writes an eventlog, which should serve as a trigger for another script.
The backup should be carried out under a newly created user witch is an administrator and a member of the administrator-group.
Now the problem is that the ".batch" file only runs when the user is logged in.
To test, I then tried to run the backup with the default Windows administrator. Than the Postscript worked with this user regardless whether the user was logged in or not.
So the conclusion is obvious that the newly created admin user lacks any rights. I just don't know what rights these are and how I assign them to the new user.

I hope you can help me.

BR,

Moritz

Accepted answer

6 additional answers

Your answer

Answer 1

MotoX80 36,401

Is there anyone who knows the reason for this problem ?

When you log out, any interactive processes that you were running are terminated. When you log back in, sometimes software configures a system tray program to launch for the user. Windows 10 also has a nasty "feature" of reopening certain programs that were running when the user logged off. See this link.

The main issue here is that you are not asking about specific Windows functionality, you are asking about how Novabackup works. Maybe someone who also uses Novabackup will see this post and can share their experiences, but I would think that you would be better off posting this question in a Novabackup forum.

I will guess that some Novabackup program is restarting when you log back in. But I do not have that software installed, and I have no way to recreate your problem so that I could troubleshoot it further.

I would suggest that you focus on defining a schedule and run the backups that way. Those should be executed by the service and have no dependency on any interactive user.

Trying different accounts was a good idea. Heck, try a Backup-Admin3. In the backup job/schedule use the same account for all settings. Be sure to click the "Check credentials" button. Use my logging example for all bat files so that you can capture any errors and see which account the bat file is executing as.

Run gpedit.msc and check to see that both success and failure is enabled for logon events. When your backup runs, you should see a logon event for whatever backup account you used.

How to install gpedit on Win10 Home.

MCK_De 21 Reputation points

2020-12-14T15:29:21.653+00:00

The main issue here is that you are not asking about specific Windows functionality, you are asking about how Novabackup works. Maybe someone who also uses Novabackup will see this post and can share their experiences, but I would think that you would be better off posting this question in a Novabackup forum.

Yes I thing the same, but I asked this question because the Novabackup support told me that the problems are the user rights.
But now I know more and will now check again at Novabackup.

Trying different accounts was a good idea. Heck, try a Backup-Admin3. In the backup job/schedule use the same account for all settings. Be sure to click the "Check credentials" button. Use my logging example for all bat files so that you can capture any errors and see which account the bat file is executing as.

I will try this, thanks.
MotoX80 36,401 Reputation points

2020-12-14T16:11:48.01+00:00

If it is a rights issue, then I would hope that the failure auditing would generate an event is the Security event log. You could also try enabling failure auditing for object access and privilege use. If you audit for success, you might get a lot of events.

I would also expect there to be a Novabackup log for the job where any error it encounters would be noted.

As a last resort, my favorite tool is Process Monitor. But the events that it captures is very very very low level. What you could do is define a very simple backup job, say maybe just backup one folder, but have everything else configured. Start a procmon capture, then kick off the backup that fails. As soon as the backup ends stop the procmon capture. In the trace search for the names of your bat files and see if any are accessed. Also search for "access denied". Maybe you will find something.

Good luck.

Answer 2

MotoX80 36,401

which writes an eventlog, which should serve as a trigger for another script.

What processes the "trigger"? Is it the Windows Task Scheduler? A Novaback program that is running as a Windows service? Something else?

If it's the Windows task scheduler, just run compmgmt.msc and change the task definition to "Run whether the user is logged on or not". You will need to enter the users password when you do that.

So the conclusion is obvious that the newly created admin user lacks any rights.

That's easy to determine. Open an admin command prompt and run "net user whatevertheusersidis".Look to see if Administrators is included in Local Group Membership". That should be sufficient. If it is not listed, add it with this command "net localgroup administrators whatevertheuseridis /add"

MCK_De 21 Reputation points

2020-12-12T10:26:40.097+00:00

The trigger is creaded by .batch script which is executed by the Novabackup program after each backup-job. Then another .batch file is executed by the Windows task scheduler depending on the written trigger. The problem is that the trigger is not written when the user is logged out. So the process through the Windows task scheduler after the trigger was written is not the problem.

The new user "Backup-Administrator" is already a member if the administrator-groupe.

(sorry, the picture is in german, but i hope you can do something with it anyway)

Answer 3

Kapil Arya 8,461 MVP Volunteer Moderator

So the conclusion is obvious that the newly created admin user lacks any rights.

That's true and IMO, when you create a new user account, it is added as standard user. You need to add it to administrator group either using Settings app, Netplwiz or via Command Prompt, if you want new user to be an administrator.

MCK_De 21 Reputation points

2020-12-12T09:21:20.683+00:00

But the new user is a member of the administrator-group allready. So I think it should have the same rights like the default Windows administrator.

Or do i misunderstanding something ?

Answer 4

The trigger is creaded by .batch script which is executed by the Novabackup program after each backup-job. Then another .batch file is executed by the Windows task scheduler depending on the written trigger.

So you have a task that is defined to run when some event is written to one of the Windows event logs. The event log entry is "the trigger", correct? Is the task defined like this for some event that Novabackup creates? Like this. Is that correct? Do you you see the event in the appropriate event log?

Now the problem is that the ".batch" file only runs when the user is logged in.

The problem is that the trigger is not written when the user is logged out.

Did you mean to say that "The problem is that the trigger is not written when the user is logged in"?

So the process through the Windows task scheduler after the trigger was written is not the problem.

Well then I'm confused. If the task scheduler is not the problem then that must mean that it is successfully executing the task. Does the task scheduler run the task or not?

Look in the history log of the task. Did it run or not? Does the process that the task runs create a log file anywhere? You may need to enable "all tasks history".

What account is the task defined to run with? This new admin account? Is it set to run if the user is logged in or not?

If the task scheduler is not the problem, then what is supposed to happen next? Is the Novabackup program supposed to run the next backup? Have you examined whatever log that that program generates?

MCK_De 21 Reputation points

2020-12-12T16:48:54.93+00:00

Sorry, I had to write it as answer because it was to long for a Comment.

Answer 5

ok i think i made it a little confusing.
The backup program (Novabackup) can execute a script after the backup job has been completed, which is defined in the program. This is carried out with the user specified in the program (here the new user "Backup-Administrator"). The script (.bat) attached to the program should now write a Windows eventlog, which is then used as a trigger for a task of the Windows Task Scheduler. The Windows Task Scheduler then executes another script (.bat) which then restarts the backup program and ejects a hard disk. From the task in the Windows Task Scheduler everything works so far (this task is carried out as the default Windows Administrator anyway ...).
The problem now exists with the script which is executed by the backup program (Novabackup) after the backup job (and should write the eventlog).
Like the entire backup program, this is executed under the new user (Backup-Administrator). The problem is that this script is only executed when the user "Bachup-Administrator" is logged in. In other words, when he is locked out, no eventlog is written.

Then I changed the user who runs the backup program to the default Windows Administrator for a test and then the eventlog was written even if all user were logged out.

I hope that explains the problem a little more.

Share via

Windows administrator rights

6 additional answers

Your answer