Windows Server 2016 – UAC prompts blocking automation and scheduled tasks – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Unattended scripts and scheduled tasks fail because User Account Control prompts for elevation interactively, breaking automation jobs that previously ran silently on Windows Server 2016.

Environment & Reproduction

Seen on member servers and standalone hosts after security baselines or GPO drift toggles UAC behavior. Reproduce by running an elevated batch job from a non-interactive session.

Get-ItemProperty 'HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem' | Select EnableLUA,ConsentPromptBehaviorAdmin,FilterAdministratorToken
Get-ScheduledTask | Where-Object {$_.State -eq 'Ready'} | Select TaskName,Principal

Root Cause Analysis

Baselines tightened ConsentPromptBehaviorAdmin or enabled Admin Approval Mode for the built-in Administrator, causing token filtering during non-interactive runs.

Quick Triage

Inspect current UAC registry values and recent policy applications.

secedit /export /cfg C:Tempuac.cfg /areas SECURITYPOLICY
Get-WinEvent -LogName 'Microsoft-Windows-GroupPolicy/Operational' -MaxEvents 20

Step-by-Step Diagnosis

Check the policy origin, task principal, and whether the task is set to run with highest privileges or as SYSTEM.

gpresult /h C:Tempgp.html /f
Get-ScheduledTask -TaskName 'NightlyJob' | Select -ExpandProperty Principal
schtasks /query /tn 'NightlyJob' /v /fo LIST

Solution – Primary Fix

Configure tasks to run as SYSTEM or a service account with highest privileges, and align UAC policy with admin automation needs.

schtasks /change /tn 'NightlyJob' /ru 'NT AUTHORITYSYSTEM' /rl HIGHEST
Set-ItemProperty 'HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem' -Name ConsentPromptBehaviorAdmin -Value 0
gpupdate /force

Solution – Alternative Approaches

Use a managed service account or gMSA so credentials and elevation are handled outside UAC consent paths.

New-ADServiceAccount -Name svc-jobs -DNSHostName svc-jobs.corp.local -PrincipalsAllowedToRetrieveManagedPassword 'CORPAppServers'
Install-ADServiceAccount -Identity svc-jobs
schtasks /change /tn 'NightlyJob' /ru 'CORPsvc-jobs$'

Verification & Acceptance Criteria

Scheduled job runs unattended and writes expected output without consent dialogs.

Get-ScheduledTaskInfo -TaskName 'NightlyJob' | Select LastRunTime,LastTaskResult
Get-WinEvent -LogName 'Microsoft-Windows-TaskScheduler/Operational' -MaxEvents 10

Rollback Plan

Revert UAC registry tweaks to defaults if elevation policy must remain strict.

Set-ItemProperty 'HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem' -Name ConsentPromptBehaviorAdmin -Value 5
gpupdate /force

Prevention & Hardening

Standardise automation on gMSAs, document UAC baselines, and review scheduled tasks for principal/elevation alignment quarterly.

Get-ADServiceAccount -Filter * | Select Name,Enabled
Get-ScheduledTask | Export-Clixml C:Temptasks-baseline.xml

Related Errors & Cross-Refs

Often related to Smart Screen, AppLocker rule blocks, and Credential Guard interaction with legacy automation tooling.

Related tutorial: View the step-by-step tutorial for Windows Server 2016.

View all Windows Server 2016 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Microsoft Learn: User Account Control settings, Task Scheduler security, and gMSA deployment guidance.