How to create scheduled task that runs under user some_domain\my_user and does not require logon in Windows 11 task scheduler?

Question

I am trying to define task with the following options as seen in task scheduler GUI:

"When running the task, use the following user account:" some_domain\my_user
"Run whether user is logged on or not": Ticked
"Do not store password. [...]": Unticked

some_domain\my_user is a real Active Directory user and it has administrator privileges on the machine where the task is supposed to run - however, it is not a "local user" on this machine.

https://filestore.community.support.microsoft.com/api/images/be37bf2e-32eb-403a-b595-eec4e17f2212

I am able to enter all these details and create the task (when using the GUI to select the user I actually cannot find it in the list of users - it's not a local user - but I still can enter it manually). When I'm asked for password I provide it and the task is created (when I enter wrong password it doesn't get created).

However after creating the task the summary now shows "When running the task, use the following user account:" my_user, i.e. some_domain\ prefix is gone.

And then when I try to run the task or it's triggered automatically it fails and I'm given error code 2147943726 which appears to mean "unknown user name or bad password".

I speculate that something responsible for getting credentials at runtime is trying to find user "my_user" instead of "some_domain\my_user" and fails.

The solutions I got from here: https://stackoverflow.com/questions/44348330/task-scheduler-failed-to-start-additional-data-error-value-2147943726 or here: https://stackoverflow.com/questions/13965997/powershell-set-a-scheduled-task-to-run-when-user-isnt-logged-in don't appear to work.

Answer 1

When you select "Whether or not the user is logged in or not" requires valid credentials. This task is run outside of the userprofile, and as such, the task needs to login in parallel which requires valid login credentials.

Entering the correct username, but a bad password, therefor, is not going to work.

You can choose to uncheck the logged in or not option, so the user must always be logged in. That way, the script runs under the currently logged in user. This does mean the user can interact with the task. So if the script starts a program or takes a while, the user will see that.

When you select: Don't remember password, you will make the program run as guest.

Given that you already chose to use this option, I suspect you won't be using any network resources anyway.

What I do in such case, is change the user to NTAUTHORITY\SYSTEM (type in system and let it autocomplete), this will automatically give it highest privileges, and works in almost all cases without any hassle.

EDIT: Also, there's a weird bug that a task can fail if the name of the task contains spaces. Try creating a new task (renaming won't work) and use a _ instead of a space, and it should work.