Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 7901 Source: Schedule

The <command> command failed to start due to the following error: The system cannot find the path specified.
See ME119919 and ME174769 for information about this event.
I was getting this error when I tried to run a scheduled task under unprivileged user, a member of Users group. For such users granting “Logon as a batch job” is not enough. You are likely to be getting two types of errors:

1. “Could not start / 0x80070005: Access is denied / 7901 General access denied error”. This error occurs when you try to schedule a batch file (cmd, bat, or vbs) for execution, because Microsoft implemented various restrictions for unprivileged users, which prevent them from running scripts under certain conditions.
2. “Last result: 0x80”. This error just means that your user does not have enough privileges to run this file. These are not only privileges that you can grant users via Local Computer Policy, but also permissions on files in %SystemRoot% directory.

Because I was not allowed to use Local System account for scheduled jobs, I added this user to Local Administrators group and granted/denied it the following permissions:
• Deny access to this computer from network.
• Deny logon locally.
• Deny logon through Terminal Services.
• Logon as a batch job.
• Password never expires.
• User cannot change password.

Additionally you may run into “Could not start” error when trying to run a scheduled task from network share. This is due to NT AUTHORITY\SYSTEM not having proper authentication to perform networking operations.
- Command: At9.job - See ME883279 for a workaround.

See ME329962 for a hotfix applicable to Microsoft Windows 2000.

See MSW2KDB for general information on this event.
The message indicates the failure of the Schedule service to start a job. The reason can be a typo in the path or name of the script or lack of rights to access that particular location (the proper rights have to be given the the account used to run the Schedule service).

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.