Checking "Run with highest privileges" option raises access denied error

Feb 4, 2013 at 4:15 PM
Hi David,

In one of our test machines running 64-bit Windows 7 Pro, selecting the Run with highest privileges option causes an Access denied error:

Access denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)) at

Microsoft.Win32.TaskScheduler.V2Interop.ITaskFolder.RegisterTaskDefinition(String Path, ITaskDefinition pDefinition, Int32 flags, Object UserId, Object password, TaskLogonType LogonType, Object sddl)
at Microsoft.Win32.TaskScheduler.TaskFolder.RegisterTaskDefinition(String Path, TaskDefinition definition, TaskCreation createType, String UserId, String password, TaskLogonType LogonType, String sddl)
at Microsoft.Win32.TaskScheduler.TaskFolder.RegisterTaskDefinition(String Path, TaskDefinition definition)
at ...


The error originates from a call to the RegisterChanges() method (see last line):

public void RegisterChanges()
{
if (this.Definition.Principal.LogonType == TaskLogonType.InteractiveTokenOrPassword || this.Definition.Principal.LogonType == TaskLogonType.Password)
throw new System.Security.SecurityException("Tasks which have been registered previously with stored passwords must use the TaskFolder.RegisterTaskDefinition method for updates.");

TaskService.GetFolder(System.IO.Path.GetDirectoryName(this.Path)).RegisterTaskDefinition(this.Name, this.Definition);
}

Settings:
Run whether user is logged on or not. Do not store password
Run with highest privileges

I did run icalcs to set write permissions to the tasks folder (c:\windows\system32\tasks), to no avail.

Thanks, Audi
Coordinator
Feb 4, 2013 at 7:18 PM
Just to confirm, if you run the exact same code and do not set the Run with Highest Privileges option, it will register successfully?
Feb 4, 2013 at 7:21 PM
Yes, it will register successfully when the Run with Highest Privileges option is not set.
Coordinator
Feb 4, 2013 at 7:26 PM
Check out the conditions for IPrincipal::RunLevel and let me know if they apply to your use case. I suspect this may be the problem.
Feb 5, 2013 at 3:46 PM
Thanks David. On the "problematic" machine, the E_ACCESSDENIED error is raised regardless of the type of user -- administrators, administrator groups, non-administrators, etc. I thought the issue is related to the following link (but after performing the "fix", the issue still persists):

http://social.technet.microsoft.com/Forums/eu/winserverGP/thread/67734412-bb17-42d5-80ff-0edf3147c169

Interestingly, if I schedule a task within our application with the "Run with highest privileges" option unchecked, and then open the same task using the built-in Windows Task Scheduler, I'm able to set the "Run with highest privileges" option from there!

I'm out out ideas why the following call is raising an access denied error:

TaskService.GetFolder(System.IO.Path.GetDirectoryName(this.Path)).RegisterTaskDefinition(this.Name, this.Definition);

Thanks, Audi
Coordinator
Feb 5, 2013 at 10:02 PM
Is UAC turned on and are you running the executable "as Administrator"?
Feb 6, 2013 at 1:57 PM
David -- you're the man!!! Yes UAC is turned on, and running our executable "as Administrator" did the trick!

Thank you so much for your help! I really appreciate it.

Audi :-)