I have a GPO that gives my Win10 workstations two scheduled tasks.
Task one runs C:\Program Files\Windows Defender\MpCmdRun.exe -removedefinitions -dynamicsignatures
Task two runs C:\Program Files\Windows Defender\MpCmdRun.exe -SignatureUpdate
Both are run with SYSTEM with Highest Privliges and whether the user is logged in or not:
Workstations successfully get both tasks from this GPO. Task 1 runs a few minutes prior to Task 2 - they are related and need to be done in that order but Task 1 takes about 30 seconds to actually run to completion.
Workstations all successfully run Task 1, blowing away the definitions.
Workstations all fail to run Task 2 when left to its own devices, however.
Task 2 is set to run as System regardless of people being logged in or not - just like Task 1. However, if I just schedule it for some random time (and I've tried many), the Scheduled Task will always kick off and die within 1 second with error code 0x2 - which is File Not Found. In the Task History on a random workstation, I will find it sometimes has an entry claiming "return code 2147942402" - which is also "File Not Found".
This is confusing because the file in question is the exact same as seen in Task 1, which does not return a failure code.
Now, if on that same failed workstation I right-click the task and hit "Run", they'll both complete successfully. Running the commands manually also works. Further, if I schedule the exact same task for some time during the day and remain logged into a sample workstation (or workstations) through the time the scheduled tasks are supposed to kick off, they actually will run successfully without user interaction!
So if no one is watching, it wont run Task 2 but if someone runs it manually OR just happens to be logged in, it runs. It does this in spite of both tasks being SYSTEM and being permitted to do it regardless of someone being logged in or not.
I am pretty confused at this point since the only difference between the two tasks is some flags. That it runs at all indicates the task is set up correctly but still only one of these will run without someone logged in.
Does anyone have some kind of lead I can follow on this?