How to Fix PowerShell Script Failing with gMSA in Task Scheduler
Question details
A PowerShell script running under a group Managed Service Account (gMSA) in Task Scheduler fails to create Azure AD shadow accounts.
- Product
- Active Directory / Task Scheduler
- Device & OS
- not provided
- Scenario
- Automating user account creation by running a scheduled PowerShell script with a gMSA.
- Observed behavior
- The script works perfectly when run interactively but fails when triggered by Task Scheduler, even though the account has service logon and local administrator rights.
Ensure you have Domain Administrator privileges to modify Organizational Unit (OU) security permissions in Active Directory before proceeding.
Grant gMSA Permissions on Active Directory Organizational Units
The gMSA requires explicit permissions to create and manage user objects within the specific OUs where the shadow accounts are being generated.
Local administrator rights and service logon privileges on the server are not sufficient for modifying Active Directory objects. The gMSA must be granted delegated permissions directly on the target Organizational Units.
Launch 'Active Directory Users and Computers' (ADUC) on your domain controller or through Remote Server Administration Tools (RSAT).
Click on the 'View' menu at the top and check 'Advanced Features' to reveal the Security tab for objects.
Right-click the target Organizational Unit (OU) where the accounts need to be created, select 'Properties', and navigate to the 'Security' tab.
Click 'Advanced', then 'Add'. Click 'Select a principal', search for your gMSA account (ensure 'Service Accounts' is checked in Object Types), and click 'OK'.
In the permission entry window, change 'Applies to' to 'Descendant User objects'. Check the boxes for 'Create User objects' and 'Delete User objects', then click 'OK' and 'Apply'.
Boost IT Productivity with WPS Office
While troubleshooting Windows Server and Active Directory environments, streamline your IT documentation, scripting logs, and reporting with WPS Office. It provides a lightweight, highly compatible alternative to Microsoft Office.
- 1. Download the Installer: Visit the official WPS Office website and click the free download button for your operating system.
- 2. Install the Suite: Run the downloaded installer and follow the on-screen setup instructions.
- 3. Start Documenting: Launch WPS Office to easily open, edit, and save any Microsoft Office document.
Frequently Asked Questions
Why does my PowerShell script work interactively but fail in Task Scheduler?
Interactive sessions use your current logged-in user credentials, which often have higher Active Directory permissions (like Domain Admin rights). Task Scheduler runs as the assigned service account, which may lack specific AD permissions.
What is a Group Managed Service Account (gMSA)?
A gMSA is a special type of Active Directory account used for services and automated tasks. It provides automatic password management and simplified service principal name (SPN) management across multiple servers.
Do I need to assign 'Log on as a batch job' rights to my gMSA?
Yes. To run automated scripts in Windows Task Scheduler, the gMSA must be granted the 'Log on as a batch job' right via the local security policy of the machine executing the task.
