windows - Powershell script does not run via Scheduled Tasks -


i have small script on domain controller setup email me via smtp latest security event 4740.

the script, when executed manually, run intended; however, when setup run via scheduled tasks, , although shows have been executed, nothing happens (no email).

the script follows:

if (-not ([security.principal.windowsprincipal][security.principal.windowsidentity]::getcurrent()).isinrole([security.principal.windowsbuiltinrole] "administrator"))  {    $arguments = "& '" + $myinvocation.mycommand.definition + "'" start-process powershell -verb runas -argumentlist $arguments break }  $event = get-eventlog -logname security -instanceid 4740 -newest 5 $mailbody= $event.message + "`r`n`t" + $event.timegenerated  $mailsubject= "security event 4740 - detected" $smtpclient = new-object system.net.mail.smtpclient $smtpclient.host = "smtp.domain.com" $mailmessage = new-object system.net.mail.mailmessage $mailmessage.from = "fromemail@domain.com" $mailmessage.to.add("toemail.domain.com") $mailmessage.isbodyhtml = 1 $mailmessage.subject = $mailsubject $mailmessage.body = $mailbody $smtpclient.send($mailmessage) 

scheduled task setup follows:

runsas:local system  trigger: on event - log: security, event id: 4740  action:  start program - c:\windows\system32\windowspowershell\v1.0\powershell.exe    argument:  -executionpolicy bypass c:\path\event4740.ps1 

i have tried following:

trigger: on event - log: security, event id: 4740  action:  start program - c:\path\event4740.ps1 

according tasks history: task started, action started, created task process, action completed, task completed. have looked through various links on site same 'issue' seem have sort of variable not have. have tried of mentioned solutions thinking may related, alas nothing working. have tried removing scheduled task , resetting mentioned here: http://blogs.technet.com/b/heyscriptingguy/archive/2012/08/11/weekend-scripter-use-the-windows-task-scheduler-to-run-a-windows-powershell-script.aspx

has run type of error before or know how bypass issue?

troubleshooting:

i decided try call .bat file via scheduled task. created simple file echo current date/time monitored folder. running file manually , via task triggered 4740 event achieved desired results. changing .bat file instead call .ps1 file worked manually. when triggered 4740 event, .bat no longer run.

change action :

powershell -noprofile -executionpolicy bypass -file c:\path\event4740.ps1

edit: updated

on windows 2008 server r2 : in task scheduler under general tab - make sure runas user set account right permissions takes execute script.

also, believe have "run when user logged on" option checked off. change "run whether user logged on or not". leave not store password option unchecked, , you'll need "run highest privileges" option marked.


Comments

Popular posts from this blog

c# - Send Image in Json : 400 Bad request -

jquery - Fancybox - apply a function to several elements -

An easy way to program an Android keyboard layout app -