6.2.22 Settings for executing jobs as a user with administrator permissions when the UAC is enabled

When the Windows UAC function is enabled, all OS users who belong to the Administrator group, with the exception of the built-in Administrator, execute operations with the Administrator permissions disabled. In JP1/AJS3, however, jobs that require administrator permissions^# might not be executable.

#

These jobs include PC jobs, action jobs, custom jobs, and QUEUE jobs that are executed in Windows versions of JP1/AJS3. Also included are submit jobs executed by the jpqjobsub command.

One example of a job that requires administrator permissions is starting a service by using the net start command. When the UAC function is enabled, jobs that require administrator permissions can be executed by the built-in Administrator and an OS user whose account is the same as the JP1/AJS3 service account.

Enabling the settings for executing jobs as a user with administrator permissions when the UAC is enabled allows OS users in the Administrator group to execute jobs that require administrator permissions even when the UAC function is enabled.

The following table describes the relationship between the type of OS user when a job is executed and whether the job can be executed when the UAC function is enabled.

Table 6‒41: Relationship between type of OS user when a job is executed and whether the job can be executed when the UAC function is enabled

Job execution service	OS user type when the job is executed			Whether a job that requires administrator permissions can be executed
				Setting disabled (default)	Setting enabled
Standard specified	OS user who is a member of the Administrator group	Built-in Administrator		Y	Y
		User other than the built-in Administrator	OS user who is the same as the service account's OS user	Y	Y
			OS user who is different from the service account's OS user	N	Y
	OS user who is not a member of the Administrator group			N	N
Queueless Agent specified	OS user who is a member of the Administrator group	Built-in Administrator		Y	Y
		User other than the built-in Administrator	OS user who is the same as the service account's OS user	N	Y
			OS user who is different from the service account's OS user	N	Y
	OS user who is not a member of the Administrator group			N	N

Legend:

Y: Can be executed.

N: Cannot be executed.

Cautionary note:

To enable the setting, first check all OS users who have been registered on the execution host by the JP1/Base user mapping function, and who execute jobs. Next, set the Log on as a batch job permission in the security policy settings for these OS users. If an OS user without this permission attempts to execute a job, even when the job does not require administrator permissions, job startup will fail and the KAVU7201-E or KAVS1880-E message is output.

When the Deny logon as a batch job permission has been set, an attempt to start the job also fails and the KAVU7201-E or KAVS1880-E message is output.

Use the following procedure to enable the setting.

Note that the setting must be enabled on the host on which the jobs will be executed.

Organization of this subsection

• (1) Definition procedure

• (2) Environment setting parameter