Scheduled task running as SYSTEM - execute something as current user?

I have a scheduled task which runs a batch file which does some stuff. I want the batch file to kick off another batch file which runs in user space; i.e. %username% == the currently logged-in user, with user permissions, etc. How can I run a command under the current user, given that the scheduled task runs with SYSTEM permissions?

I need this for both Windows XP and Windows 7.

Solution 1:

Ever since the introduction of Terminal Services, "current user" can be plural. Even XP supports fast user switching.

The closest you can get is "user connected to the console session". For this, use WTSGetActiveConsoleSessionId() + WTSQueryUserToken() + CreateEnvironmentBlock() + CreateProcessAsUser().

I wrote this: https://gist.github.com/871048 – Compile, run with full path to your batch file as arguments.

Yes, this requires .NET Runtime, but it's likely that your systems already have it. The compiler's part of the Runtime, too: %SystemRoot%\Microsoft.NET\Framework64\v3.5\csc.exe (any version starting with v2.* will work).

Note: WTSQueryUserToken() requires the program to be running as LocalSystem. (According to the docs, SeTcbPrivilege is not enough, but I haven't checked.)

Solution 2:

Under "When Running Task, use the following user account:" you can set it to "BUILTIN\Users" group, it will run the task as the current logged in user.