WinSecWiki

WinSecWiki » Windows Security Settings » Local Policies » User Rights Assignment » User Rights In-Depth » Deny logon as a batch job

Deny logon as a batch job

Expand / Collapse
 
     

Deny logon as a batch job


AKA: SeDenyBatchLogonRight, Deny logon as a batch job

Default assignment: None

This is the opposite of Log on as a batch job and any user with both rights will be denied batch logons. See discussion of logon rights.

This right would be useful for explicitly denying users the ability to run Scheduled Tasks under their own account. Scheduling tasks running under an admin/operator’s personal account is bad practice since the jobs will fail if and when the person leaves the organization and their account is disabled or deleted or if the account is locked out due to repeated password failures. In addition, the user must remember to edit all scheduled tasks when he changes his password.

Add Your Comments


Name: *
Email Address:
Web Address:
Verification Code:
*
 

Details
Article not rated yet.
Article has been viewed 1,299 times.
Options