This policy setting determines whether members of the Server Operators group are allowed to submit jobs by means of the AT schedule facility. The impact of this policy setting configuration should be small for most organizations. Users, including those in the Server Operators group, will still be able to create jobs by means of the Task Scheduler Wizard, but those jobs will run in the context of the account with which the user authenticates when they set up the job. Note: An AT Service Account can be modified to select a different account rather than the LOCAL SYSTEM account. To change the account, open System Tools, click Scheduled Tasks, and then click Accessories folder. Then click AT Service Account on the Advanced menu. This policy setting determines whether members of the Server Operators group are allowed to submit jobs by means of the AT schedule facility. Fix: (1) GPO: Computer ConfigurationWindows SettingsSecurity SettingsLocal PoliciesSecurity Options!Domain controller: Allow server operators to schedule tasks (2) REG: HKEY_LOCAL_MACHINESystemCurrentControlSetControlLsa!SubmitControl

[disable/enable]

(1) GPO: Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options!Domain controller: Allow server operators to schedule tasks (2) REG: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa!SubmitControl