powershell Scheduled Task throws SeTcbPrivilege security message

mindmischief

New Member
Joined
Jan 11, 2021
Messages
1
I have a Scheduled Task that runs a powershell script. The script copies a file from a remote server to the local server and then deletes the local file if the date-modified is older than 30 mins. The task is using an Active Directory resource account. This resource account is not in any local groups but is allowed to run batch jobs.
Powershell:

Code:
Copy-Item -Path \\server.example.com\directory\file.txt -Destination D:\directory\file.txt
Get-ChildItem -path D:\directory | where {$_.Lastwritetime -lt (date).addminutes(-30)} | remove-item

The script works when the Task is ran but I see an 'Audit Failure' message in the Security log that mentions SeTcbPrivilege.
Is this something I should worry about?
If so then how should I handle this?
Just to see if it stops the event log I tried adding the user as an administrator but that didn't change anything.
 


Solution
The audit failure may be the result of either how the task is configured or the lack of permissions the account has. If the task completes correctly then I wouldn't worry about it.

SeTcbPrivilege is act as the operating system which you generally should not grant to an account unless you need to debug something.
The audit failure may be the result of either how the task is configured or the lack of permissions the account has. If the task completes correctly then I wouldn't worry about it.

SeTcbPrivilege is act as the operating system which you generally should not grant to an account unless you need to debug something.
 


Solution
Back
Top