Log on as a batch job: how to grant the right in Windows

Applies to: Windows 11, Windows 10 and Windows Server. secpol.msc is included in Pro, Enterprise and Education; Home users can use the secedit method. You need an administrator account.

What the right does and who has it

“Log on as a batch job” (internal name SeBatchLogonRight) lets an account sign in without anyone at the keyboard so a process can run under it. Task Scheduler is the main user: when a task is set to Run whether user is logged on or not, Windows signs the task’s account in as a batch job. Without the right, the task fails with Logon failure: the user has not been granted the requested logon type at this computer (0x80070569), or Task Scheduler warns that the account lacks the right when you save the task.

Who has it by default, according to Microsoft:

Computer type	Default members
Windows 11 / 10 client	Administrators
Member or stand-alone server	Administrators, Backup Operators, Performance Log Users
Domain controller	Administrators, Backup Operators, Performance Log Users

When you create a task and type the account’s password, Windows normally grants the right to that account by itself. You usually only have to step in when a policy blocks that, when the account is a dedicated service account, or when a GPO controls the list.

Grant it on one PC with Local Security Policy

1. Press Win + R, type secpol.msc and press Enter.
2. In the left pane, open Security Settings > Local Policies > User Rights Assignment.
3. Double-click Log on as a batch job. If Add User or Group is greyed out, a domain GPO controls this setting; use the Group Policy steps instead.
4. Click Add User or Group, type the account (for example PC01\backup-svc or CONTOSO\svc-reports), click Check Names, then OK twice.
5. Open Deny log on as a batch job in the same list and make sure neither the account nor a group it belongs to is there.
6. Run the scheduled task again. No restart is needed; the change applies the next time the account signs in, which for a task is its next run.

Grant the right to a specific account or a small group you created for the purpose, not to Users or Everyone. Any account with the right can run code on the PC unattended.

Grant it to many PCs with Group Policy

In a domain, edit the policy in the Group Policy Management Console so every targeted PC gets the same list.

1. Create or edit a GPO linked to the OU that holds the computers (not the users).
2. Go to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment.
3. Double-click Log on as a batch job, tick Define these policy settings and add the accounts.
4. Also add the groups that should keep the right, such as Administrators (and on servers Backup Operators and Performance Log Users). Defining the setting in a GPO replaces each PC’s local list instead of adding to it.
5. On a target PC, run gpupdate /force in an elevated Command Prompt, then test the task.

Watch out: because the GPO replaces the local list, accounts that Windows or an app added locally (for example an IIS application pool identity, or an account added when a task was saved) lose the right, and Windows can no longer add task accounts by itself. Microsoft also recommends setting this right locally, not by domain GPO, on IIS servers. List every account that needs it, or leave the setting undefined in the GPO and grant it locally.

Windows Home: grant it with secedit

Home editions don’t include secpol.msc, but the secedit tool can export and re-import the user rights. Make a copy of the exported file before you edit it, and change only the one line.

1. Open Command Prompt as administrator and get the account’s SID: wmic useraccount where name="backup-svc" get sid (or run whoami /user while signed in as that account).
2. Export the current rights: secedit /export /cfg C:\temp\rights.inf /areas USER_RIGHTS (create C:\temp first).
3. Open C:\temp\rights.inf in Notepad. Find the line that starts with SeBatchLogonRight and add a comma and the SID with a leading asterisk, for example SeBatchLogonRight = *S-1-5-32-544,*S-1-5-21-...-1001. If the line doesn’t exist, add it under [Privilege Rights]. Save the file.
4. Import it: secedit /configure /db C:\Windows\security\local.sdb /cfg C:\temp\rights.inf /areas USER_RIGHTS.

wmic is being removed from newer Windows 11 builds; if it is missing, use whoami /user as the target account, or PowerShell: (Get-LocalUser backup-svc).SID.Value. If you would rather have the graphical tools, see how to upgrade Home to Pro.

If the task still fails

• Check the Deny right first. An account in both lists is denied. Groups count too, so look for Guests or custom groups.
• Check which GPO wins. Run gpresult /h C:\temp\gp.html and open the report; under User Rights Assignment it shows the winning GPO for each right.
• Re-enter the password in the task. If the account’s password changed, open the task, click OK and type the new password. This is a separate cause with similar symptoms.
• Check the other logon rights. A task set to run only when the user is logged on runs in the user’s existing session rather than a batch logon, so failures there usually point to the user’s normal sign-in rights instead (see “The sign-in method you’re trying to use isn’t allowed”).

For an example of a simple scheduled task to test with, see how to schedule a shutdown in Windows.

Related guides

• How to install the Group Policy Management Console on Windows 11
• How to schedule a shutdown in Windows 11 and 10
• The sign-in method you’re trying to use isn’t allowed
• How to open Command Prompt as administrator

Official sources:

• Microsoft Learn: Log on as a batch job (security policy setting)