Home / server / Questions / 69559
Accepted
Joakim
Asked: 2009-09-30 02:18:35 +0800 CST

Turn off "isolation mode" in Vista Task Scheduler?

  • 772

In Windows Vista (and I assume Windows 7) Microsoft has improved the security of processes that are run through the Task Scheduler, namely http://technet.microsoft.com/en-us/appcompat/aa906020.aspx:

In the Windows Vista Task Scheduler, security is vastly improved. Task Scheduler supports a security isolation model in which each set of tasks running in a specific security context starts in a separate session. Tasks executed for different users are launched in separate window sessions, in complete isolation from one other and from tasks running in the machine (system) context.

The problem is that I have a script that needs to run at a set interval and upload a file via SCP to a Linux webserver, to do this I'm using Pageant to store the SSH key which the script then can fetch. All this works fine in Windows XP, but because of the isolation mode in Windows Vista, the script is not allowed to talk to the Pageant process it seems, and the SCP transfer fails.

There is an option in the Task Scheduler configuration util where you can choose "Configure for Windows Server 2003, Windows XP, or Windows 2000", this at least makes the task run interactively which I also want, but the isolation mode still seems to be enabled.

Question: Is there any way to turn off the new "isolation mode" in the Windows Vista Task Scheduler so that it behaves just like how Windows XP did, allowing interprocess communication?

Update: I don't know if this is something that should be affected by "Session 0 Isolation", but in the document on that page it mentions the following:

A service tries to use window message functions such as SendMessage and PostMessage to communicate with an application. This does not work because the application is running in a different session and therefore has a different message queue. The messages never arrive at their destination. The same is true for applications that try to communicate with services through window messages.

Which Pageant does... But should this also be the case when "Configure for Windows XP" is enabled?

security

2 Answers

  1. Best Answer

    This problem turned out to be because of the isolation mode I describe present in Vista/Win7. The way Pageant works when talking to client applications is by sending and receiving simple Window Messages. This method does not work when the process i isolated, since the programs are running in different sessions with different message loops.

    I ended up solving this by rewriting pageant and the client applications in the putty suite to use named pipes instead. I've submitted a patch to the putty devs but as of writing this it has not been merged into the trunk. Thanks open source! :)

    • 1

  2. Because you said that it works fin when running manually, check where you're running the script from, the "Start In (optional)" folder.

    I don't know if it's related, but our scripts never run properly, even with all the Admin Privileges, if this isn't specified (trying to run the script from C:\Windows\system32, which is highly protected, I believe).

    See if that makes any difference.

    • 0