Difference between BUILTIN\Administrators and normal Administrators Group

Question

I have a script which launches an app on the VM and logs some data for the app. As Powershell script does not allow me to run the app in foreground I decided to schedule a task after 2 mins and then keep polling for the task completion.

I was using this command to register my task

 $password= "password" | ConvertTo-SecureString -asPlainText -Force; 
 $username = "name";
 $credential = New-Object System.Management.Automation.PSCredential($username,$password);
 Invoke-Command -VMName INSTANCE_ID -Credential $credential -ScriptBlock 
      {
        $gettime = (Get-Date).AddMinutes(2);
        $run = $gettime.ToString('HH:mm');
        $action = New-ScheduledTaskAction -Execute 'C:\logging.bat';
        $trigger = New-ScheduledTaskTrigger -Once -At $run;
        $principal = New-ScheduledTaskPrincipal -GroupID "BUILTIN\Administrators" -RunLevel Highest;
        Register-ScheduledTask -Action $action -Trigger $trigger -Principal $principal -TaskName "ID_Logging_Task" -Description "my description"
       }

It was working fine but it had a problem that it ran well only when the user was logged in. More context - https://learn.microsoft.com/en-us/powershell/module/scheduledtasks/new-scheduledtaskprincipal?view=windowsserver2022-ps (Example 2)

So I looked at the documentation of Register-ScheduledTask and saw that I can provide username and password to the command while registering the task. So I took the username of the account with Administrator privileges and ran the new command:

 $password= "password" | ConvertTo-SecureString -asPlainText -Force; 
 $username = "name";
 $credential = New-Object System.Management.Automation.PSCredential($username,$password);
 Invoke-Command -VMName INSTANCE_ID -Credential $credential -ScriptBlock 
      {
        $gettime = (Get-Date).AddMinutes(2);
        $run = $gettime.ToString('HH:mm');
        $action = New-ScheduledTaskAction -Execute 'C:\logging.bat';
        $trigger = New-ScheduledTaskTrigger -Once -At $run;
        Register-ScheduledTask -Action $action -Trigger $trigger -TaskName "ID_Logging_Task" -RunLevel Highest -User "myUser" -Password "myPassword" -Description "my description"
       }

"myUser" is an administrator on this machine. This solved the problem of running the task without manually logging in but now my app is getting launched in the background instead of foreground which was the whole point of running these scheduled tasks.

My question is what is the difference between BUILTIN\Administrators and an Administrator account. And how do I solve my problem? I want to run my task with the privilege of -GroupID "BUILTIN\Administrators" without actually logging into the machine.

score 1 · Accepted Answer · answered Apr 03 '22 at 14:11

1

Difference between the group and account

BuiltIn\Administrators is a group you can be a member of.

Administrator is a default account that comes, normally disabled, on new Windows installations.

There is a way of fixing this problem, maybe easier than it seems.

Achieving what you want

I have a script which launches an app on the VM and logs some data for the app

Let's break doing this into three pieces

Launching the VM

If you want your VM to always be running, you can set it to 'Always Start'. This option is great because it will start the VM with the host, and you can even specify a startup delay, which is great because this lessens the pressure on disk and cpu, as starting a vm will incur a spike to both those resources.

If you do this, this takes care of starting the VM.

Launching the app

For the next piece this is as simple as the syntax you already have for running a scheduled task. If you want to run as a domain account and run as an administrator, just make the domain account a member of the 'Administrators' group on the system.

Running in Foreground

Here is the wrinkle, but I don't understand why this is an issue. Scheduled Tasks will only run in the Foreground when a user is logged into the machine.

This option is there so that you can make an app appear in the user's session when they log onto a computer, for things like Kiosk apps, or Point-Of-sale systems, dashboard displays and that sort of thing.

If you set an app to run whether or not a user is logged in, then it always will run in the background.

Are you sure this matters?

Making an app run in the foreground on boot If you want an app to run without having to login, it will run in the background.

If you really want it to run in the foreground, then just set the machine to automatically log in. If it automatically log's in, then it will login and show the desktop, and then the scheduled task can be changed to 'Run only when a user is logged in', which will make it run in the foreground.

But why would someone need an App within a VM, which is by nature headless to run in the foreground?

answered Apr 03 '22 at 14:11

FoxDeploy

12,569
2
33
48

Thanks a lot for the detailed answer @FoxDeploy . Here are a few issues, 1) I always create a new instance of the VM because I need to run this for various run time configs. So I can't keep the VM running. 2) I need my app in the foreground because the way my logger app works is that it requires my app's window to send events to. 3) How can I make my VM instance automatically logged in? I already try to search for this but could find a satisfactory answer, if this works this should fix my problems as I already am able to achieve foreground running with logged in user. – arielBodyLotion Apr 03 '22 at 14:31
Also my question was what is the difference between BUILTIN\Administrator and another account with Administrator privileges. I have even enabled the administrator account and tried passing it's creds in the second script in my question but that did not work either. I am asking this question because when I pass BUILTIN\Administrator as group ID my app runs in foreground which is what I want(but only when I am logged in). @Fox – arielBodyLotion Apr 03 '22 at 14:36
I don't know if you're in the position, but it might be possible to rewrite the app from being a console app to be a proper service, maybe one you send messages via queue messages over http or Events? If you make a new instance of the VM every time, it is possible to capture an image set to automatically login with a certain account. Combine that with the scheduled tasks you're doing, you're there. If the VM autologs in and the event fires, it is effectively in foreground, even if no one is looking at it. – FoxDeploy Apr 03 '22 at 15:13
There is zero difference between `BuiltIn\Administrator` and any other account that is a member of the Administrators group. To verify, launch 'Computer Management' then browse to 'Local user and groups', you will see that `BuiltIn\Administrator` is just a member of the default `Administrators` group. That's the only way it gets permissions at all. – FoxDeploy Apr 03 '22 at 15:15
1) Any tutorial on auto logging in to the VM? 2) Then why do the 2 scripts I have uploaded work differently? Why does first one run the app in foreground? – arielBodyLotion Apr 03 '22 at 15:24
1. Google 'how to autologon to ', it is a very common task. 2. Someone *must* be logged onto a computer interactively in order to an app to run in the foreground. Otherwise it always runs in the background. That's why I am suggesting to set the system to auto-logon. If it auto-logon's and you set the task to 'run when a user logs in', then it will be run in the foreground. – FoxDeploy Apr 03 '22 at 16:56
I tried the following things for auto-logon 1)untick the checkbox above 'Users must enter a user name and password to use this computer' option. 2) Set HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon registries for defautl username and password. 3) Disabled lock screen at Computer Configuration\Administrative Templates\Control Panel\Personalization. None of them worked. – arielBodyLotion Apr 03 '22 at 16:59
For anyone who is not able to set auto logon via traditional methods you can try using - https://learn.microsoft.com/en-us/sysinternals/downloads/autologon – arielBodyLotion Apr 04 '22 at 15:49
Setting auto logon and using my initial script worked for me. Thanks a lot @Fox for your help. – arielBodyLotion Apr 04 '22 at 15:50

Difference between BUILTIN\Administrators and normal Administrators Group

1 Answers1

Difference between the group and account

Achieving what you want

Linked