powershell Scheduled Task throws SeTcbPrivilege security message

mindmischief

New Member
I have a Scheduled Task that runs a powershell script. The script copies a file from a remote server to the local server and then deletes the local file if the date-modified is older than 30 mins. The task is using an Active Directory resource account. This resource account is not in any local groups but is allowed to run batch jobs.
Powershell:

Code:
Copy-Item -Path \\server.example.com\directory\file.txt -Destination D:\directory\file.txt
Get-ChildItem -path D:\directory | where {$_.Lastwritetime -lt (date).addminutes(-30)} | remove-item

The script works when the Task is ran but I see an 'Audit Failure' message in the Security log that mentions SeTcbPrivilege.
Is this something I should worry about?
If so then how should I handle this?
Just to see if it stops the event log I tried adding the user as an administrator but that didn't change anything.
 
The audit failure may be the result of either how the task is configured or the lack of permissions the account has. If the task completes correctly then I wouldn't worry about it.

SeTcbPrivilege is act as the operating system which you generally should not grant to an account unless you need to debug something.
 
Back
Top