I got it fixed! (at least for my servers)
I found that there as a group policy applied to domain controllers (which
must have been there by default as this is a 3 month old domain and I didn't
put that policy there). In the "Default Domain Contollers Policy" I found
that the "Log on as batch service" setting was being defined:
"Default Domain Contollers Policy"\Computer configuration\windows
settings\security settings\local policies\user rights assignment\Log on as
batch service
What would apparently happen was when the job was setup (or the password
reset) it would grant the user accoutn Log on as batch service permissions.
Then the next time the group policy update came down it would overwrite
those setting and NOT have the proper account listed.
To fix the problem I added Domain\DomainAdmin to the policy setting in the
group policy and then ran "gpedit /force" on the problem server to force
that policy update. Moments later my job was starting like normal.
The key was that resetting the password would cause the task schedule to
update the local security policy and let the task run. Then when the group
policy update came down it would wipe out the setting in the local security
policy. Some time later I would reset the password, and the task scheduler
would add that account back to the Log on as batch service security policy
until the group policy pushed another updated, and round and round we'd go.
I wanted to post it up for anyone who still is scratching their head about
this one!
--Andrew Duey, MCSE NT4
url:
http://ureader.com/msg/13383624.aspx