ntrights – grant/revoke Logon As Batch Job rights
Posted by jpluimers on 2016/05/11
Sometimes you want to run a batch file from a Task Scheduler task. For that, the user under which the task runs needs to Logon as a batch job right. If it hasn’t, you get this nice error message:
“This task requires that the user account specified has log on as batch job rights”.
Despite being part of the Windows Server 2003 Resource Kit Tools, you can still use ntrights in more modern Windows versions to grant or revoke this right.
As ntrights uses a hard to remember SeBatchLogonRight name for it and I tend to forget the ntrights syntax, I wrote two batch files to grant or revoke the Logon as Batch Job rights for the specified user:
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| if [%*]==[] goto :help | |
| ntrights +r SeBatchLogonRight -u %* | |
| goto :eof | |
| :help | |
| echo Grant the Logon as Batch Job policy to a user | |
| echo See http://www.morgantechspace.com/2014/03/Set-Logon-as-batch-job-rights-to-User-by-Powershell-CSharp-CMD.html | |
| echo Syntax %~0 [domain\]username |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| if [%*]==[] goto :help | |
| ntrights -r SeBatchLogonRight -u %* | |
| goto :eof | |
| :help | |
| echo Revoke the Logon as Batch Job policy to a user | |
| echo See http://www.morgantechspace.com/2014/03/Set-Logon-as-batch-job-rights-to-User-by-Powershell-CSharp-CMD.html | |
| echo Syntax %~0 [domain\]username |
Later I found out you can also do the same from C# or PowerShell, see: Set Logon as batch job rights to User by Powershell, C# and CMD.
Note that for domain users, not only the local policies apply, but also the domain policies might apply. So often it is easier to great a local user with virtually no rights (heck, not even in a group) as a bootstrap. See Scheduling a task in Windows Server 2008 R2 – Stack Overflow for more details.
–jeroen
via:
- Task Scheduler – Log on as a batch job Policy Settings | audministrator.
- ntrights – Google Search.
- Download Windows Server 2003 Resource Kit Tools from Official Microsoft Download Center.
- How to set logon user rights by using the NTRights utility.
- Log on as a batch job / Log on as a batch job.
- Deny logon as a batch job / Deny logon as a batch job.
- Granting the Log On as Batch Job Right.
- Scheduling a task in Windows Server 2008 R2 – Stack Overflow.
- This task requires that the user account specified has log on as batch job rights – Winshuttle Support.
The Wiert Corner - irregular stream of stuff 
Leave a Reply