gMSA and "log on as batch job" privilege to run a scheduled task not mandatory ?

Chris Net 11 Reputation points
2022-07-11T15:20:47.097+00:00

Hi folks,

I was definitely sure that a gMSA needs "logon as a batch job" to run a scheduled task. But I've noticed on one of our servers that a scheduled task launch by a gMSA was running fine although the gMSA was missing this privilege !

So today I've installed a new DC from scratch in an isolated environment and I get the same result. Can someone please check on his server if a scheduled task launched by a gMSA can run if the gMSA doesn't have a "log on as a batch job" privilege ?

Thank you.

Chris

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,126 questions

5 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Chris Net 11 Reputation points
    2022-07-12T09:05:54.243+00:00

    @RLWA32 : Yes I did.
    I've tried installing a new the DC from the ISO not from a VMware template wondering if there was a problem with our template.
    Same observation.

    Here is an illustration :

    219863-gmsa.png

    0 comments
  2. Fific Armin IT/IOS/PL-Ö 0 Reputation points
    2023-02-01T09:14:44.21+00:00

    Hello, I wonder this aswell. Why does it work without being a member of the group "LogonAsBatch"?

    Is it because of this property  "PrincipalsAllowedToRetrieveManagedPassword" on the serviceaccount (gMSA)?

    0 comments
  3. RLWA32 40,286 Reputation points
    2023-02-01T10:00:23.1266667+00:00

    By default members of the local Administrators group have the logon as batch privilege

  4. Chris Net 11 Reputation points
    2023-02-01T10:05:36.5933333+00:00

    a gMSA account is not a member of the local administrators group by default. It's a non privileged account by default.

  5. Limitless Technology 43,931 Reputation points
    2023-02-03T08:04:13.5466667+00:00

    Hi. Thank you for your question and reaching out. I’d be more than happy to help you with your query.

    Yes, in order to run tasks in the Task Scheduler, gMSA accounts must logon as a batch job. Furthermore, it's crucial to confirm that the gMSA account has the authorizations required to access the resources it need to finish the task. This entails giving the account the required user rights in addition to the access privileges it needs to use shared network resources.

    If the reply was helpful, please don’t forget to upvote or accept as answer, thank you.

    0 comments