Allowing Local Standard Account Log On As Batch Job Rights

Hi,

At the risk of sounding naive, I hope someone can help with the following situation.

I created a task in Task Scheduler for the standard user account to have Windows Defender check for and update signatures every 3 hours rather than the once per day default setting.

However, when running the task the command prompt window remained open, which I did not want.

I logged in as administrator and as the title says allowed the standard user log on as a batch job rights which then allowed me to set the task to not have the window open.

So far so good, but the question is whether or not I have now lowered the security of both the standard and admin accounts by changing the setting in secpol.msc to allow the rights.

Any input appreciated, even if the suggestion is to undo what I set up.

Thanks!

Just to clarify, did you originally run the Defender check using a batch command and schedule the task using "Run with highest privileges"? If so, and the scheduled task you created did run sucessfully and your only issue is that "when running the task the command prompt window remained open, which I did not want", then you could try to run the task by creating a .vbscript and using the .vbs which calls the .bat file. This should hide the command prompt window.


Copy the following into Notepad and save it for example as "C:\test\Defendercheck.vbs"


Set WshShell = CreateObject("WScript.Shell" )
WshShell.Run chr(34) & "C:\full path to your Defender check file batch file.bat" & Chr(34), 0
Set WshShell = Nothing

(Of course, replace "C:\full path to your Defender check file batch file.bat" with exact path of your own original Batch file)


In task Scheduler, call the Defendercheck.vbs using
C:\Windows\System32\wscript.exe as the program and the "C:\test\Defendercheck.vbs" file as the argument using its full path.


For information on using the vbscript, see "Community Chosen Answer" here for how to make the vbscript work (in case you don't know):

QA: Completely invisible batch file. | ITNinja

more info here:
Hide Command Window of .BAT file that Executes Another .EXE File - Stack Overflow

I haven't tried it myself, but worth trying instead of changing Group Policy settings which may have security implications according to:

Log on as a batch job (Windows 10) | Microsoft Docs
which says :"Use discretion when assigning this right to specific users for security reasons."

Log on as a batch job (Windows 10) | Microsoft Docs




If the .vbscript approach doesn't work, just reverse the changes until somebody more knowledgeable chips in.

Good luck.

I would test it out like this.

1 Undo the GPE.
2 If the task ran without highest previleges set, you can try the .vbs approach. If that does not work, enable the "highest previleges"
3 If that doesn't work, you can set up everything as before, as, as it is a personal computer, it may be safe to change the GPE to your requirement. ( Althogh having said that, the .vbs approach might still be the best as it means that you will never have to worry about any possible security issues related to that GP setting in future .)

nb: Sorry, I just read Try3s meassage, and he has some valid points there too .

Thanks to both of you, das10 and Denis.

I fully take on board the comments about security.

Here are the changes I have made:

1. removed the log on as a batch job rights for the standard account in GPE

2. set task back to "Run only when user is logged on"

3. added a "minimized" parameter in the task. Instead of the command prompt sitting there it now briefly flashes and disappears. Not ideal, but it will do for now.

It is starting to get late here and I do not have the energy to read up on vbs etc. but I will try and take the time to look into that further.

Thanks again for all the help.

Try3 said:

By the way, you could protect yourself from the risk of user profile corruption inherent in only having one account on the computer by creating two password-protected local admin accounts.
- Add Local Account or Microsoft Account - TenForumsTutorials
- If you do ever suffer from user profile corruption you would be able to use one of them to sort things out.
- Having these accounts ready for use would turn a potential catastrophe into a minor annoyance. You would be able to avoid having to use any of my long-winded guidance on that subject.
- Always write down the account passwords somewhere secure yet readily accessible. Mine are inside a thing on my keyring [photo in the long-winded article above].

Denis

I have two accounts on this machine, one under my regular name which is the admin account that came with the laptop and a second, standard account, which I use for work and everyday usage.

Both accounts are password protected of course.

Do you still recommend adding a second local admin account re. what you wrote above?