Granting "Logon as a batch job"

Tue, 06/18/2019 - 17:35 By Dave Brooks
Admin logging in

What is "Logon as Batch job"?

I remember when I first encountered this error:

"Logon failure: the user has not been granted the requested logon type at this computer."

Here's how the problem breaks down. RPM Remote Print ManagerĀ® ("RPM") is a Windows system service. Like any other service, it has special permissions on your local machine.

For security reasons, Microsoft decided to prevent Windows services from working the same way on the network. So, for example, RPM can't use shared printers or shared folders directly because they are on your network, not your local computer.

On the other hand, a typical logged-in user can easily use shared printers and folders. You have this right as part of your user profile.

A service like RPM gets around this by impersonating a logged-in user while printing or opening a file. That's one of the permissions that a service program has. So when you configure an action to use a regular user's login credentials for the printer or folder, you accomplish that by using the RPM user interface.

The second requirement is that this user must have "Logon as batch job" permissions in their profile. Setting this permission keeps a hacker from maliciously creating user accounts to do whatever it wants. Only an admin, logged in, can assign this permission to a user profile.

To summarize, here is a chart which presents the problem:

User Permissions
Windows service Can use local printers and folders
Logged-in users Can use local and shared printers and folder
Impersonated users Must have "logon as batch job" set in the profile

How we first encountered this problem

Let's set up this scenario. The customer used RPM Remote Print ManagerĀ® (RPM) with an "Archive to folder" action using a domain service account to write files to folders on a network share. The user account has the correct credentials.

When the user next processes a print job using this action, they get the following error.

"Error 1385 - Logon failure: the user has not been granted the requested logon type at this computer."

The reason we had never encountered this error is this. When I wrote and tested this function in RPM, I used my login account (since we don't share passwords around in the company). My regular user profile has "Logon as Batch Job" because I'm one of the admin users.

A typical user would not have that; hence, the error.

What should I do about "Logon as Batch job"?

These instructions assume you are using Windows 10 or comparable.

  1. Go to the lower left of your home screen so that the search bar appears.
  2. As shown in the example below, type in "secpol.msc" indicated by the red arrow.
  3. Don't hit Enter yet; look for the menu to appear. Notice the four options to the right; you want the highlighted option "Run as administrator"

    Running secpol as admin

  4. In the "Local Security Policy" app, go to Security Settings / Local Policies / User Rights Administration. These are collapsing menus that you open by clicking the ">" arrow, one at a time.
  5. Scroll down to "Log on as a batch job" and double click on that entry

    User rights assignment in Local Security Policy

The "Select Users" form is where you would add the user you have configured for the RPM archive to the shared folder operation.

Note that I have put myself in this form: BROOKS\Dave

However, you might have noticed that the security policy already includes that user. If you were adding a user, you would do that here.

Selecting users

It won't hurt anything to click "Check Names" if you have never done this before. Chances are, if you entered the domain and username correctly, you wouldn't have a problem.

Why RPM Remote Print Manager needs "Logon as Batch Job"

RPM Remote Print Manager uses Logon as Batch Job

RPM Remote Print ManagerĀ® is a print server software and a virtual printer with the ability to process print jobs as a specific Windows user. As you well know, sometimes the permissions make this necessary; for instance, if you want to

  • write to a shared folder
  • print a shared printer
  • run a program interactively.

We are pleased to make this page available to you. Helping our users makes us all successful, and we're happy to share the information with the community.

If you need a print server or virtual printer, please download the free trial today! And best of luck with your "log on as batch" issues from here on out.