HOW TO: Prevent Users from Changing Scheduled Tasks in Windows 2000 (314970)

SUMMARY

You can use the Windows 2000 Task Scheduler to make sure that specific programs open, or scripts run at a predetermined time. This is useful for making sure that system utilities or programs run on the computer of a user when you want, without the user having to remember to start the program. This article describes how to prevent users from changing scheduled tasks in Windows 2000.

back to the top

Prevent Users from Changing Scheduled Tasks

The Windows 2000 Task Scheduler runs in the background. By default Windows 2000 Task Scheduler starts when you start Windows 2000. However, unless you take steps to prevent it, users can change the scheduling of tasks or even delete them. In a highly controlled environment, you may want to prevent users from changing scheduled tasks. To do this:

Set User Account Permissions

Set the advanced permissions on files and folders to deny users permission to view or change a scheduled task. To do this, follow these steps:

1. Start the Scheduled Tasks utility. To do this, click Start, point to Programs, point to Accessories, point to System Tools, and then click Scheduled Tasks.
2. Right-click the task where you want to configure permissions, and then click Properties.
3. Click the Security tab, and then click Advanced.
4. Click Add, click the user or group that you want to prevent from changing or deleting the scheduled task, and then click OK.
5. Assign the permissions that you want. For example, click to select the following check boxes in the Deny column of the Permissions list:

   Read Permissions
   Change Permissions

6. Click OK, and then click OK to quit the Access Control Settings for Scheduled Task dialog box (where Scheduled Task is the task that you are modifying).
7. Click Yes to confirm that you want to continue, and then click OK.

back to the top

Use a Group Policy Object

You can use Windows 2000 Group Policy settings to deny users the ability to delete or create tasks. To do so, follow these steps:

1. Start the Active Directory Users and Computers utility.
   
   To do this, click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
2. Right-click the domain or organizational unit where you want to create the Group Policy object (GPO), and then click Properties.
3. Click the Group Policy tab, and then click New.
4. Type a descriptive name for the GPO, and then press ENTER.
5. Click Properties, and then click the Security tab.
6. In the Name list, click the user or group that you want to prevent from having these Group Policy settings applied (if any), and then click to clear the following check boxes in the Allow column of the Permissions list:

   Read
   Apply Group Policy

7. Click OK, and then click Edit.
8. Under User Configuration, expand Administrative Templates, expand Windows Components, and then click Task Scheduler.
9. In the right pane, double click Disable Task Deletion.
10. Click Enabled, and then click OK.
11. Quit the Group Policy dialog box, and then click Close.

back to the top