Access denied when using schtasks from PHP (IIS) on windows server

Question

I'm trying to run schtasks with exec() but always get an access denied error as response.

On my local win10 machine it works seamlessly but on windows server 2019 the scrip exits with the error. I found serveral similar questions but wether they had no answeer or the given answer didn't work for my specific problem. Unfortunately the error doesn't specify WHO is missing permition to WHAT. So i tryed giving the IUSR and the IIS_USERS access to the cmd.exe, the schtasks.exe and the taks folder (C:\Windows\System32\Tasks) according to some other answers.

My code example:

$results = array(
    "output" => NULL,
    "code" => NULL
);
exec(
    'schtasks /create /sc MONTHLY /tn AtlantisPrint /tr C:\SoftwarehausHeider\Atlantis\prog\atlantis.exe /ru Administrator /rp XXXX /f 2>&1',
    $results["output"],
    $results["code"]
);
echo "<pre>" . print_r($results, TRUE) . "</pre>";

Results in:

Array
(
    [output] => Array
        (
            [0] => Zugriff verweigert // translates to *Access denied*
        )

    [code] => 1
)

If i run the command in the command line it works. I also tryed to use runas /user:IUSR with the command but it results in a request to enter the password for IUSR which i know nor how to get it.

It's PHP 7.4 on an IIS 10.0 in case that this is relevant.

I'm thankful for any suggestion which permissions are missing here.

Edit (2021-10-26):

Other things i tried by now are deactivating the UAC, removing the write protection from the task folder and deactivating the firewall. But it still says 'Access denied'.

Answer 1

Hi @SWH-TW ,

Maybe some group policy limit the IIS or application pool to do something. That is you need to check. Please use process monitor to check what make process create task failed.

Answer 2

it's the IIS account associated with website. if an anonymous site, then the anonymous user need to be admin. This not a great option, you might want to make a Webapi site that just has this function and call it.

Answer 3

Hi @SWH-TW ,

I tried to reproduce the issue but failed. It worked well on my server 2019. I just change the .exe file to chrome.exe.

UAC was not involved in my testing. When I set the IUSR permission, it didn't work immediately but displayed a 401 error, which is not the same as your error. So I set permissions for the application pool test, both of which are full control permissions. Then it worked.
So I think you can try to add "IIS Apppool\app pool name" and give it full control permission.

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Best regards,
Bruce Zhang