windows - Powershell script does not run via Scheduled Tasks -
i have small script on domain controller setup email me via smtp latest security event 4740.
the script, when executed manually, run intended; however, when setup run via scheduled tasks, , although shows have been executed, nothing happens (no email).
the script follows:
if (-not ([security.principal.windowsprincipal][security.principal.windowsidentity]::getcurrent()).isinrole([security.principal.windowsbuiltinrole] "administrator")) { $arguments = "& '" + $myinvocation.mycommand.definition + "'" start-process powershell -verb runas -argumentlist $arguments break } $event = get-eventlog -logname security -instanceid 4740 -newest 5 $mailbody= $event.message + "`r`n`t" + $event.timegenerated $mailsubject= "security event 4740 - detected" $smtpclient = new-object system.net.mail.smtpclient $smtpclient.host = "smtp.domain.com" $mailmessage = new-object system.net.mail.mailmessage $mailmessage.from = "fromemail@domain.com" $mailmessage.to.add("toemail.domain.com") $mailmessage.isbodyhtml = 1 $mailmessage.subject = $mailsubject $mailmessage.body = $mailbody $smtpclient.send($mailmessage)
scheduled task setup follows:
runsas:local system trigger: on event - log: security, event id: 4740 action: start program - c:\windows\system32\windowspowershell\v1.0\powershell.exe argument: -executionpolicy bypass c:\path\event4740.ps1
i have tried following:
trigger: on event - log: security, event id: 4740 action: start program - c:\path\event4740.ps1
according tasks history: task started, action started, created task process, action completed, task completed. have looked through various links on site same 'issue' seem have sort of variable not have. have tried of mentioned solutions thinking may related, alas nothing working. have tried removing scheduled task , resetting mentioned here: http://blogs.technet.com/b/heyscriptingguy/archive/2012/08/11/weekend-scripter-use-the-windows-task-scheduler-to-run-a-windows-powershell-script.aspx
has run type of error before or know how bypass issue?
troubleshooting:
i decided try call .bat file via scheduled task. created simple file echo current date/time monitored folder. running file manually , via task triggered 4740 event achieved desired results. changing .bat file instead call .ps1 file worked manually. when triggered 4740 event, .bat no longer run.
change action :
powershell -noprofile -executionpolicy bypass -file c:\path\event4740.ps1
edit: updated
on windows 2008 server r2 : in task scheduler under general tab - make sure runas user set account right permissions takes execute script.
also, believe have "run when user logged on" option checked off. change "run whether user logged on or not". leave not store password option unchecked, , you'll need "run highest privileges" option marked.
Comments
Post a Comment