mindmischief
New Member
- Joined
- Jan 11, 2021
- Messages
- 1
- Thread Author
-
- #1
I have a Scheduled Task that runs a powershell script. The script copies a file from a remote server to the local server and then deletes the local file if the date-modified is older than 30 mins. The task is using an Active Directory resource account. This resource account is not in any local groups but is allowed to run batch jobs.
Powershell:
The script works when the Task is ran but I see an 'Audit Failure' message in the Security log that mentions SeTcbPrivilege.
Is this something I should worry about?
If so then how should I handle this?
Just to see if it stops the event log I tried adding the user as an administrator but that didn't change anything.
Powershell:
Code:
Copy-Item -Path \\server.example.com\directory\file.txt -Destination D:\directory\file.txt
Get-ChildItem -path D:\directory | where {$_.Lastwritetime -lt (date).addminutes(-30)} | remove-itemThe script works when the Task is ran but I see an 'Audit Failure' message in the Security log that mentions SeTcbPrivilege.
Is this something I should worry about?
If so then how should I handle this?
Just to see if it stops the event log I tried adding the user as an administrator but that didn't change anything.