i have defined a schedule job that i would like to run as an administrator. when i save the job (after entering the account and password) i get a message that says that i need to allow the account to "logon as a batch job". when i go to User Rights Assignment, the Add USer or Group button was grayed out. The machine is a Windows 2008 standard server that is a VM (Hyper-V) that is part of a domain. I am logged in as the administrator.

Does the icon for Allow logon on a batch job in User Rights Assignment look different than some of the other settings that you can change? That setting is probably being set in a Group Policy Object at the Site/Domain/OU level and as such you can't edit it in the local security policy. Paul Adare CTO IdentIT Inc. ILM MVP

yes the icon is different so i changed it in the default domain policy on the DC, i.e. i added the administrator user account to the Logon as a batch job policy. but the admin does not appear on the other server even after i reload the policies what do i need to do to enable tis to work? thanks for your help

Hi, Please run rsop.msc on the computer. In the Resultant Set of Policy console, navigate to Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment, locate the log on as a batch job policy in the right pane, then you can check the Source GPO that takes effect on the computer. You need to configure the policy in that Source GPO. Thanks.This posting is provided "AS IS" with no warranties, and confers no rights.

I am not sure what I am looking for, but i looked on the computer (not the DC) and it shows LOCAL SERVICE and NETWORK SERVICE, with precedence of NETWORK SERVICE and LOCA SERVICE this is alos grayed out and i cannot cahnge anything

Hi, Please run gpresult /z>gpresult.txt on the computer, and then upload the gpresult.txt file to the following space: https://sftasia.one.microsoft.com/choosetransfer.aspx?key=e56e2d4a-f8fe-4993-bf0a-5f5626a24f90Password: Q#3spi0Q*TIp Thanks.This posting is provided "AS IS" with no warranties, and confers no rights.

gpresult and DCgpresult (for the domain controller) have been uploaded

Hi, According to the gpresult.txt, the policy is defined in Default Domain Policy: GPO: Default Domain Policy Policy: BatchLogonRight Computer Setting: LOCAL SERVICE NETWORK SERVICE Please edit the policy in Default Domain Policy GPO and add the user/group in the policy based on your requirement. This posting is provided "AS IS" with no warranties, and confers no rights.

Thanks, that did it!

Glad to hear that. Have a nice day. Joson ZhouTechNet Subscriber Support in forumIf you have any feedback on our support, please contact tngfb@microsoft.comThis posting is provided "AS IS" with no warranties, and confers no rights.

Hi, I am getting a similar problem with 2008 R2. Local policy is showing a domain account of DOMAIN\IIS_WPG. RSOP.msc, GPRESULT.exe and GPEDIT.MSC remotely all show correctly that this is set to the local account of IIS_WPG. This is being done only by the Default Domain Policy. However, the local policy setting, which is incorrect, is being picked up and used and we can't change it. Does anyone have any ideas? Also, why does setting this via GPO disable it locally on 2008 R2, but not for Windows 7, for example? Cheers, Rob