Score:0

My scheduled task to run MpCmdRun.exe works with one set of flags but not another (fails with 0x2 "File not found")

us flag

I have a GPO that gives my Win10 workstations two scheduled tasks.

Task one runs C:\Program Files\Windows Defender\MpCmdRun.exe -removedefinitions -dynamicsignatures

Task 1

Task two runs C:\Program Files\Windows Defender\MpCmdRun.exe -SignatureUpdate

Task 2

Both are run with SYSTEM with Highest Privliges and whether the user is logged in or not: Security Settings

Workstations successfully get both tasks from this GPO. Task 1 runs a few minutes prior to Task 2 - they are related and need to be done in that order but Task 1 takes about 30 seconds to actually run to completion.

Workstations all successfully run Task 1, blowing away the definitions.

Workstations all fail to run Task 2 when left to its own devices, however.

Task 2 is set to run as System regardless of people being logged in or not - just like Task 1. However, if I just schedule it for some random time (and I've tried many), the Scheduled Task will always kick off and die within 1 second with error code 0x2 - which is File Not Found. In the Task History on a random workstation, I will find it sometimes has an entry claiming "return code 2147942402" - which is also "File Not Found".

This is confusing because the file in question is the exact same as seen in Task 1, which does not return a failure code.

Now, if on that same failed workstation I right-click the task and hit "Run", they'll both complete successfully. Running the commands manually also works. Further, if I schedule the exact same task for some time during the day and remain logged into a sample workstation (or workstations) through the time the scheduled tasks are supposed to kick off, they actually will run successfully without user interaction!

So if no one is watching, it wont run Task 2 but if someone runs it manually OR just happens to be logged in, it runs. It does this in spite of both tasks being SYSTEM and being permitted to do it regardless of someone being logged in or not.

I am pretty confused at this point since the only difference between the two tasks is some flags. That it runs at all indicates the task is set up correctly but still only one of these will run without someone logged in.

Does anyone have some kind of lead I can follow on this?

tsc_chazz avatar
vn flag
Do not assume that the executable file is the "file not found" - it could be a definitions file that it is trying to open, it could be a temp file that doesn't exist because without a logged in user there is no temp directory defined. If it is a temp file, you might be able to get around this by defining a $TEMP and $TMP system variable that point to an existing directory with the appropriate permissions.
Score:0
bh flag

I cannot speak specifically for what it is not finding, only how to likely find it. If the application is passing an error 2 properly (which can sometimes be an error 5/53/4/other in disguise) I would use procmon form sysinternals https://learn.microsoft.com/en-us/sysinternals/downloads/procmon let the failing task run, and filter the process by your process name, look at all the file events and see what was attempted and what failed. Thst dhoufl sat least steer you into more info if not an answer.

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.