You are currently offline, waiting for your internet to reconnect

User GPP Scheduled Task item fails to apply and logs event id: 4098 with 0x80070005 "Access is denied."

Support for Windows Server 2003 ended on July 14, 2015

Microsoft ended support for Windows Server 2003 on July 14, 2015. This change has affected your software updates and security options. Learn what this means for you and how to stay protected.

SYMPTOMS
You configure the following User Group Policy Preference (GPP) item in a Windows 2008 / 2008 R2 based Active Directory Domain. 
  • User Configuration\Preferences\Control Panel Settings\Scheduled Tasks\New\"Scheduled Task (Windows Vista and later)"
  • Under the Common Settings tab, select option "Run in logged-on user’s security context (user policy option)”.
After the Group Policy is applied to a user, you find that the preference item does not take effect. Additionally, you see the following event log in the Application log: 

Event ID: 4098
Event Source: Group Policy Scheduled Tasks
Event Type: Warning

Event Description: The user '<GPP item name>' preference item in the '<GPO name> <GPO GUID>' Group Policy object did not apply because it failed with error code '0x80070005 Access is denied.' This error was suppressed.

Additionally if you enable Group Policy tracing for GPP Scheduled Tasks Client Side Extension you will see the following logged in the GPP User log file:

2010-10-12 09:59:01.337 [pid=0x3a0,tid=0x8c8] Starting class <TaskV2> - <GPP item name>.
2010-10-12 09:59:01.337 [pid=0x3a0,tid=0x8c8] Set user security context.
2010-10-12 09:59:01.337 [pid=0x3a0,tid=0x8c8] Adding child elements to RSOP.
2010-10-12 09:59:01.352 [pid=0x3a0,tid=0x8c8] WorkItem.Init [ hr = 0x80070005 "Access is denied." ]
2010-10-12 09:59:01.352 [pid=0x3a0,tid=0x8c8] Properties handled. [ hr = 0x80070005 "Access is denied." ]
2010-10-12 09:59:01.352 [pid=0x3a0,tid=0x8c8] Set system security context.
2010-10-12 09:59:01.540 [pid=0x3a0,tid=0x8c8] EVENT : The user '<GPP item name>' preference item in the '<GPO name> {GPO GUID}' Group Policy object did not apply because it failed with error code '0x80070005 Access is denied.'%100790273
2010-10-12 09:59:01.540 [pid=0x3a0,tid=0x8c8] Error suppressed. [ hr = 0x80070005 "Access is denied." ]
2010-10-12 09:59:01.540 [pid=0x3a0,tid=0x8c8] Completed class <TaskV2> - <GPP item name>.
2010-10-12 09:59:01.540 [pid=0x3a0,tid=0x8c8] Completed class <ScheduledTasks>.

You can enable GPP tracing through group policy:

Computer Configuration\Policies\Administrative Templates\System\Group Policy\Logging and Tracing\Configure Schedulled Tasks preference logging and tracing

When configured, the log file will be created in:

%SystemDrive%\ProgramData\GroupPolicy\Preference\Trace\User.log


CAUSE
The User GPP Scheduled Tasks item was not designed to run under the currently logged on users security context AND must be applied in the default system security context. 

RESOLUTION
To avoid this issue, do not enable the "Run in logged-on user’s security context (user policy option)” Common option when configuring user GPP Scheduled Tasks items.

The security context under which the Scheduled Task will run once it has been deployed can be specified in the General settings tab when creating the User GPP Scheduled Task item:

User Configuration\Preferences\Control Panel Settings\Scheduled Tasks\New\"Scheduled Task (Windows Vista and later)"

General:

Security Options -> "When running the task, use the following user account:"


By default, this is set to: %LogonDomain%\%LogonUser%

This is where the security context under which the scheduled task will run should be configured.

MORE INFORMATION
Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use for other considerations.
Properties

Article ID: 2447414 - Last Review: 10/25/2010 21:26:00 - Revision: 2.0

  • Microsoft Windows Server 2003 Service Pack 1
  • Microsoft Windows Server 2003 Service Pack 2
  • Windows Server 2008 Service Pack 2
  • KB2447414
Feedback
cript> " + "'><\/script>");