"log on as a batch job" user rights removed by what GPO?
- by LarsH
I am not much of a server administrator, but get my feet wet when I have to.
Right now I'm running some COTS software on a Windows 2008 Server machine. The software installer creates a few user accounts for running its processes, and then gives those users the right to "log on as a batch job".
Every so often (e.g. yesterday at 2:52pm and this morning at 7:50am), those rights disappear. The software then stops working. I can verify that the user rights are gone by using
secedit /export /cfg e:\temp\uraExp.inf /areas USER_RIGHTS
and I have a script that does this every 30 seconds and logs the results with a timestamp, so I know when the rights disappear.
What I see from the export is that in the "good" state, i.e. after I install the software and it's working correctly, the line for SeBatchLogonRight from the secedit export includes the user accounts created by the software. But every few hours (sometimes more), those user accounts are removed from that line. The same thing can be seen by using the GUI tool Local Security Policy > Security Settings > Local Policies > User Rights Assignment > Log on as a batch job: in the "good" state, that policy includes the needed user accounts, and in the bad state, the policy does not.
Based on the above-mentioned logging script and the timestamps at which the user rights are being removed, I can see clearly that some GPOs are causing the change. The GPO Operational log shows GPOs being processed at exactly the right times. E.g.:
Starting Registry Extension Processing.
List of applicable GPOs: (Changes were detected.)
Local Group Policy
I have run GPOs on demand using gpupdate /force, and was able to verify that this caused the User Rights to be removed.
We have looked over local group policies till our eyes are crossed, trying to figure out which one might be stripping these User Rights to "log on as a batch job." We have not configured any local group policies on this machine, that we know of; so is there a default local group policy that might typically do such a thing? Are there typical domain policies that would do this?
I have been working with our IT staff colleagues to troubleshoot the problem, but none of them are really GPO experts... They wear many hats, and they do what they need to do in order to keep most things running.
Any suggestions would be greatly appreciated!
