Access Denied: Windows Server 2003's Permissions to Cmd.exe

We recently upgraded to Windows Server 2003 from Windows 2000 Server. Everything is working fine except for several batch files that are scheduled to run each night. Our other scripts and batch files work perfectly. The only thing in common between the broken batch files is that they run under a nonadministrator account. Can you explain what changed with Windows 2003 that prevents us from running batch files as nonadministrators?

To mitigate the damage an intruder could do, Windows 2003 tightens the permissions on cmd.exe, the program that executes batch files. By default, Win2K Server grants Full Control to Administrators and to the System account and grants Read & Execute permissions to the Users group.

Windows 2003 revokes Read & Execute permissions from the Users group. The default permissions for cmd.exe in Windows 2003 give Full Control to Administrators and System and give Read & Execute permissions to the Interactive and SERVICE groups. One way to fix your scripts is to create a new group called Batch Accounts, add to that group all user accounts that run batch files, then grant the group Read & Execute access to cmd.exe.

End of Article