WinSecWiki > Security Settings > Local Policies > User Rights > User Rights In-Depth > Deny logon as a batch job
Deny logon as a batch job
AKA: SeDenyBatchLogonRight, Deny logon as a batch job
Default assignment: None
This is the opposite of Log on as a batch job and any user with both rights will be denied batch logons. See discussion of logon rights.
This right would be useful for explicitly denying users the ability to run Scheduled Tasks under their own account. Scheduling tasks running under an admin/operator’s personal account is bad practice since the jobs will fail if and when the person leaves the organization and their account is disabled or deleted or if the account is locked out due to repeated password failures. In addition, the user must remember to edit all scheduled tasks when he changes his password.
Back to top