I have scheduled a simple script on my Windows Server 2012 domain controller to backup my group policies (separate from the System State backup). I ran the script manually, and it works as expected. I scheduled the script in Task Scheduler using a service
acct with domain admin privileges. Due to our domain policy settings, I had to select the "Do not store password" option on the job, otherwise the usual error regarding "no session" is presented. This means I have access to local resources
only (on the DC).
I also right-clicked the job and selected "run" and the job executes properly. However, when the job kicked off at the scheduled time on its own, it only ran partially. The date stamped backup folder was created, and it contained a partial "manifest.xml" file which is created at every backup. The manifest only has the header in it, no other content such as GPO names and GUIDs.
In the Powershell transcript output, it generates an error when the Backup-GPO cmdlet runs:
Backup-Gpo : The system cannot open the device or file specified. (Exception from HRESULT: 0x8007006E)
The command is:
Backup-Gpo -All -Path $backup_dir\$date_stamp
And yes, I have selected to run the job without the user being logged in. Is it possible to backup domain GPOs without the credentials cached in the job? Are the GPOs considered a "local resource" on the domain controller?