Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
The <command> command failed to start due to the following error: The system cannot find the path specified.
|English: Request a translation of the event description in plain English.|
See ME119919 and ME174769 for information about this event.
I was getting this error when I tried to run a scheduled task under unprivileged user, a member of Users group. For such users granting “Logon as a batch job” is not enough. You are likely to be getting two types of errors:
1. “Could not start / 0x80070005: Access is denied / 7901 General access denied error”. This error occurs when you try to schedule a batch file (cmd, bat, or vbs) for execution, because Microsoft implemented various restrictions for unprivileged users, which prevent them from running scripts under certain conditions.
2. “Last result: 0x80”. This error just means that your user does not have enough privileges to run this file. These are not only privileges that you can grant users via Local Computer Policy, but also permissions on files in %SystemRoot% directory.
Because I was not allowed to use Local System account for scheduled jobs, I added this user to Local Administrators group and granted/denied it the following permissions:
• Deny access to this computer from network.
• Deny logon locally.
• Deny logon through Terminal Services.
• Logon as a batch job.
• Password never expires.
• User cannot change password.
Additionally you may run into “Could not start” error when trying to run a scheduled task from network share. This is due to NT AUTHORITY\SYSTEM not having proper authentication to perform networking operations.
- Command: At9.job - See ME883279 for a workaround.
See ME329962 for a hotfix applicable to Microsoft Windows 2000.
See MSW2KDB for general information on this event.
The message indicates the failure of the Schedule service to start a job. The reason can be a typo in the path or name of the script or lack of rights to access that particular location (the proper rights have to be given the the account used to run the Schedule service).
|Private comment: Subscribers only. See example of private comment|
|Links: ME119919, ME174769, ME329962, ME883279, MSW2KDB|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (1) - More links...|
Send comments or solutions
- Notify me when updated