Remotely managing Scheduled Tasks on another computer: Access Denied

Question

I need to remotely create new scheduled tasks from a Windows 7 computer in my company (which according to this Microsoft TechNet article I should be able to do. http://technet.microsoft.com/en-us/library/cc766266.aspx )

From within Task Scheduler, on the menu I click Action > Connect to another Computer. I browse for the remote computer's name (I use Check Names to verify that the name is correct) and then I check 'Connect as another user' and enter \Administrator and the local admin password.

Whenever I try this, I get the error message Task Scheduler: You do not have permission to access this computer

Firewall isn't the problem
I am able to use Remote Desktop with this username & password combo, so I would expect it to work when remotely managing as well. The remote computer has firewall exceptions for Remote Scheduled Tasks Management, Remote Service Management, and Remote Desktop among other things. Heck, I even tried turning off the firewall for that individual computer and it still didn't work.

More details:
I have administrative remote access to several other Windows 7 Enterprise computers, though I log in as the local Administrator (whose administrative rights are only recognized by that local machine, not by the domain). The computer I am managing from is on the domain, and also has administrative rights that are recognized on the domain.

More experimentation:
If I go the other way around and remote-desktop into the other machine and from there open task scheduler then 'connect to another computer', I am able to connect back to my main computer using the username & password that is recognized by an administrator on the domain, and successfully schedule a task on my main computer. So it's not a company firewall issue that's preventing anything from working.

The only permissions requirement Microsoft talks about is "The user credentials that you use to connect to the remote computer must be a member of the Administrators group on the remote computer". I'm logging in as an Administrator on each of the local machines, so why doesn't it work?

Answer 1

Try the fallowing:

1. Start MMC
2. Add the Task Scheduler
3. Select the computer and check the "Connect as another user:" checkbox
4. Click the "Set User ..." button
5. Set the user as remotecomputer\administrator
6. Use the remote computers administrator password
7. Click OK tell you are back at the MMC console.
8. See if you can access the remote computers.

Another way to do this is:

1. hold down the Shift key and right click on the "Task Scheduler" in "Administrative Tools" and selecting "Open as different user"
2. Fill out the user as remotecomputer\administrator and use the remote computer's administrator password
3. Right click on the "Task Scheduler (Local)" and select "Connect to another computer" and choose the remote computer
4. Click OK.

Answer 2

I came across this frustrating problem as well. Since as you say you can remotely login to the computer, what you can try and do instead is:

1. Remote into the machine
2. Open the task scheduler as another user, to do this shift + right click on the task scheduler executable, then select "Run as different user"
3. Enter the administrator credentials

You should then be free to edit the task as you see fit.

Of course this depends on what you actually want to accomplish. If you want to do this via script, (i.e. deploy a group of scheduled tasks across machines), I would suggest instead to script up what you would want to do via schtasks.

This allows you to create a task \Create, on a specific machine \s machine and set username and passwords for the command \U and \P. Please see the documentation here.

HTH

Answer 3

I've managed to fix this issue by adding this key to the registry:

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f

This settings controls how local administrator account is recognized when logging remotely. If that does not helps you try to enable all remote system control rules in firewall (find all that contains RPC and RPC-EPMAP in their names and enable those you think is appropriate).