I still had problems in running VBS scripts that create and save an Excel workbook when the script was run under the Windows Server 2008 Task Scheduler by an account that was not a member of the Administrators local group.
To determine the root cause of the Excel SaveAs problems, I created a simple script to create a Excel workbook and call the SaveAs method. The test script ran OK in the foreground when run with administrative priveleges, but failed when run via the Task Scheduler with an unpriveleged domain service account. I enabled Failure auditing for the domain service account on the test servers System32 Folder and all of the subfolders.
The test script was then run under the task scheduler. After each run I checked the security log for failure audit entries. I then granted the domain service account and the minimum rights to each folder that it was trying to access.
For example, the account needs the right to read the Desktop folder - that's why creating the missing Desktop folder trick works for a priveleged account. Other examples is write to:
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\mso984F.tmp
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Office\RecentAfter a number of runs and changes to permissions, the script ran OK under the task scheduler. After reviewing the security requirements, the security changes for the domain service account were removed and replaced using the following procedure.
===========================================================================
A simple vbs script to create and save an Excel spreadsheet run by the task scheduler with an account that is not a member of the Administrators local group will result in error 1004 –
“Microsoft Office Excel cannot open or save any more documents because there is not enough available memory or disk space.
• To make more memory available, close workbooks or programs you no longer need.
• To free disk space, delete files you no longer need from the disk you are saving to.”
The problems are related to the permissions on the folders under the C:\Windows\System32\config\systemprofile and the missing C:\Windows\System32\config\systemprofile\Desktop folder on Windows Server 2008.
To run a .vbs script that uses Excel under the 2008 task scheduler, make the following changes.
1. On the server, create a local group called “Script Operators”.
2. Create a domain service account to be used to run the script in the Task Scheduler and add it to the server’s “Script Operators” local group.
3. Assign “Script Operators” the required rights to the scripts folders, generally change permissions.
4. Create the missing C:\Windows\System32\config\systemprofile\Desktop folder.
5. Assign the “Script Operators” group the following rights.
|
Folder
|
Permission
|
|
C:\Windows\System32\config\systemprofile\Desktop
|
Read & Execute, List folder contents, Read
|
|
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft
|
Modify, Read & Execute, List Folder Content, Read, Write
|
|
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft
|
Modify, Read & Execute, List Folder Content, Read, Write
|
