Allowing non-admin users to trigger Task Scheduler task via shortcut

Question

I have a piece of software that can only be licensed under the current user, and I need to have it available on a lab machine where I don't know who will be logging in. I have a script that runs in Task Scheduler on user logon that can license the software each time, but I would prefer to not have it launch every time users log in (the script requires a popup window, so it's in-your-face and not a great user experience, especially for those who don't even plan on using the software). I need Task Scheduler, because it allows me to run the PowerShell script with -ExecutionPolicy Bypass, without prompting the user for admin credentials.

What I would like, is a shortcut that can manually trigger the task, so users can decide if they want to license the software or not. Unfortunately, it hasn't been working.

I made a shortcut with target: C:\Windows\System32\schtasks.exe /run /tn DBCLicenser, where DBCLicenser is the name of my task. When I try to run the shortcut, nothing happens. Running it in command prompt, I see the error: ERROR: Access is denied

Running the shortcut in an elevated command prompt succeeds, but our users are not administrators, so this is not an option.

To be clear here, the task runs successfully when the task trigger is set to User Logon. I have made sure to check "Run with highest privileges", and "Allow task to be run on demand" in the task settings.

It seems as though users do not have permission to trigger a task. I've tried manually adding permissions in C:\Windows\System32\Tasks\%%mytask%%, but it seems this fix no longer works in Windows 10.

Answer 1

I found a script here, in the comments section, that resolved the issue for me. All I had to do was insert the name of my task (e.g. [...].GetTask("myTask")), run it once, and everything worked as I wanted it to.

$scheduler = New-Object -ComObject "Schedule.Service"
$scheduler.Connect()
$task = $scheduler.GetFolder("").GetTask("")
$sec = $task.GetSecurityDescriptor(0xF)
$sec = $sec + '(A;;GRGX;;;AU)'
$task.SetSecurityDescriptor($sec, 0)

Thanks Grubi.