How can I manage what users can do with the Windows 2000 Task Scheduler?
Group Policy, at Computer Configuration\Administrative Templates\Windows
Components\Task Scheduler,
and User Configuration\Administrative Templates\Windows Components\Task Scheduler,
provides the administrator with the ability to Hide Property Pages,
Prevent Task Task Run or End, Disable Drag-and-Drop, Disable New Task Creation
Disable Task Deletion, Disable Advanced Menu, and Prohibit Browse.
NOTE: If these policies appear in both the Computer and User Configuration,
the Computer setting take precedence.
These policies do NOT limit an administrators' ability to use the AT command
or to submit jobs remotely.
The Explain tab for these Group Policies contain the following information:
Hide Property Pages
Prevents users from viewing and changing the properties of an existing task.
This policy removes the Properties item from the File menu in Scheduled Tasks
and from the context menu that appears when you right-click a task. As a result,
users cannot change any properties of a task. They can only see the properties
that appear in Detail view and in the task preview.
This policy prevents users from viewing and changing characteristics such as the
program the task runs, its schedule details, idle time and power management
settings,
and its security context.
Tip: This policy affects existing tasks only. To prevent users from changing the
properties of newly created tasks, use the "Disable Advanced Menu" policy.Prevent
Task Task Run or End
Prevents users from starting and stopping tasks manually.
This policy removes the Run and End Task items from the context menu that appears
when you right-click a task. As a result, users cannot start tasks manually
or force tasks to end before they are finished.Disable Drag-and-Drop
Prevents users from adding or removing tasks by moving or copying programs
in the Scheduled Tasks folder.
This policy disables the Cut, Copy, Paste, and Paste shortcut items on the context
menu
and the Edit menu in Scheduled Tasks. It also disables the drag-and-drop features
of the Scheduled Tasks folder.
As a results, users cannot add new scheduled tasks by dragging, moving, or copying
a document
or program into the Scheduled tasks folder.
This policy does not prevent users from using other methods to create new tasks
and it does not prevent users from deleting tasks.Disable New Task Creation
Prevents users from creating new tasks.
This policy removes the Add Scheduled Task item that starts the New Task wizard.
Also, the system does not respond when users try to move, paste, or drag programs
or documents into the Scheduled Tasks folder.Disable Task Deletion
Prevents users from deleting tasks from the Scheduled Tasks folder.
This policy removes the Delete item from the Edit menu in the Scheduled Tasks
folder
and from the menu that appears when you right-click a task. Also, the system does
not respond when users try to cut or drag a task from the Scheduled Tasks
folder.Disable Advanced Menu
Prevents users from viewing or changing the properties of newly created tasks.
This policy removes the "Open advanced properties for this task when I click
Finish"
item from the last page of the Scheduled Task wizard.
This policy prevents users from viewing and changing task characteristics,
such as the program the task runs, details of its schedule, idle time and
power management settings, and its security context.
It is designed to simplify task creation for beginning users.
Tip: This policy affects newly created tasks only. To prevent users from changing
the
properties of existing tasks, use the "Hide Property Pages" policy.Prohibit Browse
Limits newly scheduled to items on the user's Start menu and prevents the user
from changing the scheduled program for existing tasks.
This policy removes the Browse button from the Schedule Task wizard and from the
Task tab of the properties dialog box for a task. Also, users cannot edit the "Run"
box
or the "Start in" box that determine the program and path for a task.
As a result, when users create a task, they must select a program from the list in
the
Scheduled Task wizard, which displays only the tasks that appear on the Start menu
and
its submenus. Once a task is created, users cannot change the program a task runs.
Important: This policy does not prevent users from creating a new task by pasting
or
dragging any program into the Scheduled Tasks folder. To prevent this action,
use the "Disable Drag-and-Drop" policy.If the Group Policies were Not Configured,
you could implement the User based policy with the following entries:
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\
LocalUser\Software\Policies\Microsoft\Windows\Task Scheduler5.0]
"Allow Browse"=dword:00000001
"Disable Advanced"=dword:00000001
"DragAndDrop"=dword:00000001
"Execution"=dword:00000001
"Property Pages"=dword:00000001
"Task Creation"=dword:00000001
"Task Deletion"=dword:00000001
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Task Scheduler5.0]
"Allow Browse"=dword:00000001
"Disable Advanced"=dword:00000001
"DragAndDrop"=dword:00000001
"Execution"=dword:00000001
"Property Pages"=dword:00000001
"Task Creation"=dword:00000001
"Task Deletion"=dword:00000001and the Compurer based policy with:
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\
LocalMachine\Software\Policies\Microsoft\Windows\Task Scheduler5.0]
"Allow Browse"=dword:00000001
"Disable Advanced"=dword:00000001
"DragAndDrop"=dword:00000001
"Execution"=dword:00000001
"Property Pages"=dword:00000001
"Task Creation"=dword:00000001
"Task Deletion"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Task Scheduler5.0]
"Allow Browse"=dword:00000001
"Disable Advanced"=dword:00000001
"DragAndDrop"=dword:00000001
"Execution"=dword:00000001
"Property Pages"=dword:00000001
"Task Creation"=dword:00000001
"Task Deletion"=dword:00000001
