Schedule Batch files as admin from non admin accounts

See
Elevated Shortcut without UAC prompt - TenForumsTutorials
Elevated Shortcut without UAC prompt - ElevenForumTutorials

But make the tasks run at Login not Startup.
Windows really gets stroppy about running Admin work at startup because it thinks it's being hijacked.

In what way have you tried to get Task scheduler to run these tasks as Admin?
- If you want to run such tasks from non-Admin accounts without a prompt, you are going to have to save the Admin password for every such task.


Good luck,
Denis

Try3 said:

In what way have you tried to get Task scheduler to run these tasks as Admin?
- If you want to run such tasks from non-Admin accounts without a prompt, you are going to have to save the Admin password for every such task.


Good luck,
Denis

Click to expand...

Hi Denis

Just for clarification I want the script to run for both users user 001 (Admin) & user002 (Local user) The Scheduled task runs fine as admin but not user002. The guides seem to be written for Admin users only

I have tried both creating a scheduled task both in Admin (user001) and within the User (user002) accounts . I tried every way within the task scheduler context windows ' selecting 'run when user logged in' & 'run whether user is logged in or not' , running with and without 'highest privileges' and triggers 'At log in ' with both 'Any user' and 'specific user'

I am guessing the Task should be created in the user 002 account , but task scheduler gives me warning that I cannot run the task as admin ( The script needs admin , running as local user causes an error in the script )

I recall Task scheduler being really stroppy about setting up tasks to run in another user account.
I don't think I ever solved the problem that you are now trying to solve.
Task scheduler is decades old. They have tinkered with its appearance but it is still at heart the same beast that existed before Admin & Standard user accounts were dreamt up.

You can only use the 'run whether user is logged in or not' setting if the task does not have any user interface. If it has a user interface then I don't see how you can succeed. Running a cmd to copy files or set a property would be fine but even opening Notepad would not [because it has a user interface].
You'll need to log in to the standard user account [user002] then run Task scheduler and enter the Admin account name in the account to be used line, set 'run with highest privileges' & 'run whether user is logged in or not'.
When you try to save the task you'll get asked for the account password and that is where I always failed. Instead, I just decided to always use an Admin account to run Task scheduler and never to try what you are trying.

If your script could be altered so any interface was redirected into a file or a nul instead then that might work.
MyScript.bat >%Temp%\DummyOutputFileThatIWillNeverBotherReading.log


By the way, the two levels of account are Admin & Standard not Admin & Local.
- Local just means it is not linked to an online MSAccount.
- You can have Local accounts that are Admin & Local accounts that are Standard.
- You can have MSAccounts that are Admin & MSAccounts that are Standard.


This article's section 5 gives the impression that you can do what you want to do.
Everything about how to schedule tasks - WindowsReport

I think that the member @LesFerch knows more about running Admin tasks than I do so he might be able to join in to help you.


Best of luck,
Denis

Ok so tried again , using the standard user account 'user002', running as 'user001' (admin)


every time I try to run an admin task as a standard user , I get this prompt,

I enter the admin password , the credentials are correct ,so but it just complains about permissions for some reason.

The script runs fine when I simply run as admin and go through UAC

90Ninety said:

every time I try to run an admin task as a standard user , I get this prompt,

I enter the admin password , the credentials are correct ,so but it just complains about permissions for some reason.

The script runs fine when I simply run as admin and go through UAC

Click to expand...

[I've only just seen the added diagrams]

That's what I used to get and what I was never able to solve.
I think its problem is that it cannot cope with matching a username with a password for a user who is not the currently logged in user i.e. it cannot cope with an Admin giving permission to another account to run a privileged task.

But you said you got that when you run the task.
I think it used to appear when I tried to save the task definition.
I think that's what you meant.

The permission referred to is permission to create the task itself. TS does not give a monkey's what's in your script yet.


Denis

I cannot create the TS task as an admin, I can create it as a standard user but the script fails ( needs low level hardware access)


Though I can run it manually as admin


Weird this basic automation functionality seems broken

Just an idea but couldn't you
- Set up your Admin account to log in automatically [NetPlWiz]
- Set the task to run in your account as Admin
- Add a last line of your script to log you off.

Then, after every reboot, all the necessary settings will have been done and your nephew will just see a login screen?


Denis

You may need to set up one task for machine settings and one task for user settings.

The machine settings task must not do anything interactive (i.e. nothing displayed). It must simply make registry and file changes that are per machine (e.g. items in HKLM or files in common shared folders).

User settings do not typically require elevation, but some, such as a user policy setting do.

User settings that do not require elevation don't even need a scheduled task. They can be handled by a script placed in the user's startup folder or via the user's Run registry key (or RunOnce key for items that only need to run once per user). If they are handled by a scheduled task, that would obviously be set to run "only when the user is logged on".

User settings that require elevation are handled similarly to a machine settings task (i.e. nothing can be interactive) but it gets very tricky because your script is running typically via the SYSTEM account, but you're wanting to make changes to another account. If it's a protected user registry setting, for example, your script would have to find the correct user hive in the registry (if the user is logged in) or load the user's hive from disk, make the change, and unload it if the user is not logged in.

It's too much to provide all the details for every scenario, so it would be easier if you showed the commands you want to run. That should make it clear what methods and code you will need.