How to create a scheduled task under SYSTEM user account with SCHTASKS

Question

I am currently trying to get SCHTASKS to create a scheduled task under the SYSTEM account, by using the following command:

schtasks.exe" /s "\\" /u "SYSTEM" /Create /SC DAILY /MO "7" /ST "12:00" /TN "mytask" /TR  "C:\test.exe "C:\""

Although it outputs:

ERROR: User credentials are not allowed on the local machine.

Nahama

"C:\Windows\System32\schtasks.exe" /s "localhost" /RU "SYSTEM" /Create /SC DAILY /MO "7" /ST "12:00" /TN "74077054" /TR "C:\test.exe "C:\"" – Nahama

out of curiosity, why do you want to run under SYSTEM? – Hooten

You probably shouldn't be running any tasks under the SYSTEM account. The name should have given that away: it's reserved for the system, not the user, even a user with administrative privileges. Chances are very good that you're attempting to solve your problem with the wrong tools. – Laboy

Hmm, yes, that's about the only reason you would need to do this. But be warned: Our general policy around here is to discourage people from creating malware. My personal policy (and one that is shared by a non-trivial number of users) is to refuse to help people who appear to want to create malware. Thus, voting to close. – Laboy

@Cody Gray: How does running a program as SYSTEM specifically help the creation of malware? That's an absurd claim, because SYSTEM doesn't effectively grant you any more privileges than being an administrator does. I can think of plenty of reasons why you would want to schedule a task to run under the SYSTEM user. – Downpipe

@wj32: For the record, in now-deleted comments, the original poster confirmed that his aim was indeed to create malware. My initial comment said nothing at all about malware, and merely suggested that there was probably a better approach to solving the problem than running under the SYSTEM user. As I mentioned, it's named SYSTEM for a reason, to indicate that it's reserved for the system, not for user tasks, even administrative ones. I disagree with your claim that there are "plenty of reasons why you would want to schedule a task to run under the SYSTEM user". You haven't provided one. – Laboy

@Cody Gray: Non-MS services usually run as SYSTEM, so I would imagine that a scheduled task could be used to achieve something similar. In fact, if you look in the Task Scheduler console (taskschd.msc), you will find many tasks that do just this. – Downpipe

@wj32: Please don't confuse Windows Services with user-mode applications. They're completely different. And no, I don't have any scheduled tasks on my machine set to run as the SYSTEM user. I keep my machine free of malware. You should check yours. And upgrade to a modern version of Windows where this kind of thing is much less of an issue. XP is over 10 years old now. – Laboy

@Cody Gray: Excuse me? Services are user-mode programs. I'm using Windows 7, so I don't think you are looking very carefully. Many of Microsoft's default tasks run as SYSTEM. Now are you really disputing the fact that the SYSTEM user is useful for services? That's even worse than your initial claim. – Downpipe

@Downpipe Services should not run, all things being equal, as LocalSystem, an account that has greater rights than local admin. That's well accepted, and documented by MS. – Hooten

There's a really good reason to be able to run something as SYSTEM. If you've screwed up your registry such that even Administrator doesn't have access, the only way to clean it up is to schedule a task as SYSTEM to undo your damage. It's saved my bacon before. – These

Whether they should or not, the truth is that many services do run as LocalSystem. Running a Scheduled Task with SYSTEM credentials is one good way to perform necessary maintenance to the SYSTEM profile. One good example is mapping a drive that can be read by a system service. Some applications cannot operate on UNC paths but can work with a mapped drive letter if you put it in the SYSTEM profile. Another good reason to use SYSTEM is in an AD domain environment. If AD policies or ACLs give specific machines access to a resource, the SYSTEM account is the one that will be able to access it... – Quamash

Answer 1

1. Open an elevated (admin) command prompt.

2. Enter the following command:

   schtasks.exe /s "\" /ru "SYSTEM" /Create /SC DAILY /MO "7" /ST "12:00" /TN "mytask" /TR "C:\test.exe "C:\"

Please note the difference is that, in order to specify the SYSTEM account, you need to use the /RU switch and not the /U one.

Desired

Answer 2

1. Create your tasks in scheduler them export them as XML (https://superuser.com/questions/1334495)
2. Create a text file with: schtasks.exe /create /RU SYSTEM /TN "Folder\TaskName" /XML "I:\Location\TaskName.xml" as many lines as you want, with each task, then save file as batch (.bat), run as administrator (right click run as admin).
3. Apply to computers that you want to run it on.

Semiconductor