I looked into the domain's Group Policy and found that under Group Policy Objects -> Domain Policy, there was nothing configured for Log on as batch job under Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment. I added the user requiring this setting, but found it made no difference. I have created a task in Task Scheduler that must be run as this user and Task Scheduler is complaining that this user must be able to Log on as batch job. It appears that Task Scheduler only cares if this is set in Local Security Policy, and does not care what the domain's Group Policy says. This brings me back to why can I not edit the settings in Local Security Policy. What is preventing me from doing this?

create Group Policy Results report for this computer in Group Policy Management console. You will see what policy exectly has "Logon as a batch job" option configured for this computer. 'It appears that Task Scheduler only cares ...' — no, thats wrong.MCITP: Enterprise Administrator; MCT; Microsoft Security Trusted Advisor; CCNA

The changes I made above to domain Group Policy did not take effect locally until the server had been rebooted. Now the changes are in effect and I can create and run the task as the necessary user through Task Scheduler.

I need to add a user to the Log on as batch job property in the Local Security Policies on my Windows Server 2008 system. The trouble is, theAdd a User or Group and Remove buttons are greyed out. I am logged in as the administrator. What policy or setting must be changed to enable these buttons? Additional note: according to the information on Edit a Local Group Policy Object (http://technet.microsoft.com/en-us/library/cc771574.aspx), "you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO." As the Administrator, my user is in the Domain Admin group, the Enterprise Admin group, and the Group Policy Creator Owners group. This is not the first time I have found that a user belonging to a group could not access something that permissions included the group.

It appears that this policy entry is already configured on domain level. Find out what domain policy have this option configured and update it.MCITP: Enterprise Administrator; MCT; Microsoft Security Trusted Advisor; CCNA