Share via

gMSA and "log on as batch job" privilege to run a scheduled task not mandatory ?

Chris Net 36 Reputation points
2022-07-11T15:20:47.097+00:00

Hi folks,

I was definitely sure that a gMSA needs "logon as a batch job" to run a scheduled task. But I've noticed on one of our servers that a scheduled task launch by a gMSA was running fine although the gMSA was missing this privilege !

So today I've installed a new DC from scratch in an isolated environment and I get the same result. Can someone please check on his server if a scheduled task launched by a gMSA can run if the gMSA doesn't have a "log on as a batch job" privilege ?

Thank you.

Chris

Windows for business | Windows Server | User experience | Other
Answer accepted by question author
  1. rpi_dwillis77 91 Reputation points
    2025-11-09T11:22:32.4133333+00:00

    Hi @Chris Net ,

    Indeed, there appears to be a difference in how gMSAs interact with the system when compared to traditional domain accounts, in that they actually are interacting as a service rather than as a batch job. As a result, they actually require the "log on as a service" right rather than "log on as a batch job", even for scenarios where traditional accounts require "log on as a batch job" (such as scheduled tasks or running IIS app pools). I have never seen this officially documented anywhere, but just found it by combining bits and pieces of info I found in various places along with the results of my own testing. I wrote about this in detail in my answer to a similar question here:

    https://learn.microsoft.com/en-us/answers/questions/1166156/is-log-on-as-a-batch-job-required-for-gmsa-account?page=1&orderby=helpful

    Hope this helps!

    Best regards.

    1 person found this answer helpful.
    0 comments

5 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Chris Net 36 Reputation points
    2022-07-12T09:05:54.243+00:00

    @RLWA32 : Yes I did.
    I've tried installing a new the DC from the ISO not from a VMware template wondering if there was a problem with our template.
    Same observation.

    Here is an illustration :

    219863-gmsa.png

    0 comments
  2. Fific Armin IT/IOS/PL-Ö 0 Reputation points
    2023-02-01T09:14:44.21+00:00

    Hello, I wonder this aswell. Why does it work without being a member of the group "LogonAsBatch"?

    Is it because of this property  "PrincipalsAllowedToRetrieveManagedPassword" on the serviceaccount (gMSA)?

    0 comments
  3. RLWA32 51,011 Reputation points
    2023-02-01T10:00:23.1266667+00:00

    By default members of the local Administrators group have the logon as batch privilege

  4. Chris Net 36 Reputation points
    2023-02-01T10:05:36.5933333+00:00

    a gMSA account is not a member of the local administrators group by default. It's a non privileged account by default.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.