Share via

gMSA and "log on as batch job" privilege to run a scheduled task not mandatory ?

Chris Net 36 Reputation points
2022-07-11T15:20:47.097+00:00

Hi folks,

I was definitely sure that a gMSA needs "logon as a batch job" to run a scheduled task. But I've noticed on one of our servers that a scheduled task launch by a gMSA was running fine although the gMSA was missing this privilege !

So today I've installed a new DC from scratch in an isolated environment and I get the same result. Can someone please check on his server if a scheduled task launched by a gMSA can run if the gMSA doesn't have a "log on as a batch job" privilege ?

Thank you.

Chris

Windows for business | Windows Server | User experience | Other
Answer accepted by question author
  1. rpi_dwillis77 91 Reputation points
    2025-11-09T11:22:32.4133333+00:00

    Hi @Chris Net ,

    Indeed, there appears to be a difference in how gMSAs interact with the system when compared to traditional domain accounts, in that they actually are interacting as a service rather than as a batch job. As a result, they actually require the "log on as a service" right rather than "log on as a batch job", even for scenarios where traditional accounts require "log on as a batch job" (such as scheduled tasks or running IIS app pools). I have never seen this officially documented anywhere, but just found it by combining bits and pieces of info I found in various places along with the results of my own testing. I wrote about this in detail in my answer to a similar question here:

    https://learn.microsoft.com/en-us/answers/questions/1166156/is-log-on-as-a-batch-job-required-for-gmsa-account?page=1&orderby=helpful

    Hope this helps!

    Best regards.

    1 person found this answer helpful.
    0 comments

5 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Limitless Technology 45,026 Reputation points
    2023-02-03T08:04:13.5466667+00:00

    Hi. Thank you for your question and reaching out. I’d be more than happy to help you with your query.

    Yes, in order to run tasks in the Task Scheduler, gMSA accounts must logon as a batch job. Furthermore, it's crucial to confirm that the gMSA account has the authorizations required to access the resources it need to finish the task. This entails giving the account the required user rights in addition to the access privileges it needs to use shared network resources.

    If the reply was helpful, please don’t forget to upvote or accept as answer, thank you.

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.