“To determine the root cause of the Excel SaveAs problems, I created a simple script to create a Excel workbook and call the SaveAs method. The test script ran OK in the foreground when run with administrative priveleges, but failed when run via the Task Scheduler with an unpriveleged domain service account. I enabled Failure auditing for the domain service account on the test servers System32 Folder and all of the subfolders.
The test script was then run under the task scheduler. After each run I checked the security log for failure audit entries. I then granted the domain service account and the minimum rights to each folder that it was trying to access.
After a number of runs and changes to permissions, the script ran OK under the task scheduler. After reviewing the security requirements, the security changes for the domain service account were removed and replaced using the following procedure.”
被这个 RogerDoger 的技术文字打动了。我的情形是 Windows 2008 service launch DCOM service，现在仍然不理解，为什么 launching user 是特定用户的时候，还需要写系统的目录？