Authorization

Authorization

By default, in WinNT/2000/XP nnCron is started as a service and runs tasks as though they were started by "user" SYSTEM. However, by "authorizing" a task, you can run it as any other user, with all the permissions that this user would have. To perform the authorization successfully, you have to know the username (login) and password of the user in whose name the task will be run, and this user must have the necessary privileges in the system.

The authorization instructions are placed in a task before the Action: section.

In order to run a task as a user who is currently logged on a system, use option AsLoggedUser.

nnCron has some features which make it possible to run all tasks, and even start nnCron's GUI, as a specific user. (See "Authorization Options").

nnCron has a convenient tool to prevent most of errors connected with user name, domain name, password and logon type: if you select Run as user checkbox on the Time and Options tab of "New Task" dialog box, it will become possible to perform a test login in order to find out any possible errors.

Examples:

#( as_user_task
User: john Password: privy Domain: my_domain LogonInteractive
Time: 0 10 * * * *
Action:
    START-APP: as-user-app.exe
)#

#( as_user_task1
User: john Password: privy
Time: 0 10 * * * *
Action:
    START-APP: as-user-app.exe
)#

See also Note.

In order to "authorize" a task, use the following key words:

Domain: <domain>
LogonBatch
LogonInteractive
LogonNetwork
Password: <password>
SecPassword: <abracadabra>
User: <user_name>

User: <user_name>

User name (login).

In Windows XP, it may be useful to make sure that you use the actual user name and not its alias. This can be verified in Control Panel -> System -> Advanced -> User Profiles -> Settings. Profile's name is the actual username of a user.

Password: <password>

User's password

SecPassword: <abracadabra>

Encrypted user password. Here you can find a detailed description of why an encrypted password is needed and where to get one.

Domain: <domain>

Your domain. This is an optional parameter.

LogonBatch
LogonInteractive
LogonNetwork

Type of logon. This is an optional parameter.

Note: Here is another example of running a task "as a user":

#( test_auth
LoadProfile
Time: START-TIME
User: "test_user" Password: "test" Domain: "vkondakoff"  \ LogonInteractive
Action:
    \ START-APP: WINWORD.EXE
    START-APP: C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
)#

In this example, there are four points which deserve a special comment:

Word LogonInteractive can be safely omitted if nncron.ini has the line DefaultLogonType: LogonInteractive.
If an application is called without stating the full path (as in the line that was commented out), the application will be started by System. But if the full path is stated, then it will be run as by user "test_user". This has to do with some oddities in reading the registry branch HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths. (At least, Windows XP behaves in this fashion).
In Windows XP, one can login without stating one's password. In order to make it possible for nnCron to login without a password, you need to enter Local Security Settings and disable option Security Options -> Accounts: Limit local account use of blank passwords to console logon only. After that, you can omit field Password: for users without a password:

User: "empty_pass" Domain: "vkondakoff" LogonInteractive

In Win2000/XP, using option LogonBatch for some reason results in an error message Can't logon User. Error # 87. Use LogonInteractive instead.