Scheduled task runs interactively but fails under SYSTEM after domain migration with 'access denied' to network resource

Environment

Windows Server 2019 hosts joined to new Active Directory domain after migration; scheduled task configured to run a PowerShell script at 02:00 under the SYSTEM account; task executes successfully when run manually by an admin but fails when triggered by scheduler.

Symptoms

Automated nightly task that downloads files from a file server and writes to C:\Data\Imports consistently aborts with exit code 5 when run by Task Scheduler. Manual Run As (right‑click -> Run) as Local System succeeds. Admin user runs the task interactively and it succeeds.

Observations

Task history shows 'Action Failed 0x80070005' at scheduled time. PowerShell error logged to application event log indicates 'Access to \fileserver.newdomain.localackupsile.zip denied'. SMB access from the server to the file server using 'net use' as SYSTEM fails, but accessing same share under an admin user works. Kerberos preauthentication errors in Domain Controller security logs during task runtime time window. Machine account in AD shows SID history entries from old domain in attributes; trust relationship between domains is configured but constrained.

Already attempted

Verified scheduled task 'Run whether user is logged on or not' and 'Do not store password' settings. Tested alternate credentials by configuring task to run under a domain service account — then task succeeds. Reset computer account password in AD and rebooted host — no change. Tested network share access using psexec -s to a cmd prompt, attempted 'dir \fileserver...' as SYSTEM and reproduced 'Access denied'.

Question

Why does the same scheduled task succeed when invoked manually or using a domain service account but fail under SYSTEM at schedule time after the AD migration, and what safe steps will restore scheduled SYSTEM-run network access without reconfiguring the job to use stored credentials?

Post timeline

COMMUNITY RESPONSES

Verified community troubleshooting

0 replies

No answers yet..

Showing 0 of 0 community responses

AI DIAGNOSTICS

Incident analysis

Updated 1w ago• Trouble ID

Most likely causes

Machine account credentials mismatch or stale SID history leftover from domain migration preventing Kerberos authentication for SYSTEM-based network access 85%

SMB share configured to require Kerberos and machine account not trusted for delegation 80%

Time skew or intermittent DC reachability at scheduled task time causing Kerberos failures 35%

Summary

The SYSTEM account authenticates to network resources using the machine account (host$). After AD migration, the machine account's credentials/SID history or the cross-domain trust state appears inconsistent; Kerberos requests during scheduled runs are failing while interactive runs use cached or different credential paths. Running the task under an explicit domain service account bypasses machine account authentication and works, which isolates the failure to machine-account-based network auth. Resetting the machine account and rejoining domain sometimes fixes this, but the observed SID history suggests leftover attributes from the previous domain causing Kerberos or NTLM mismatches.

Suggested Fixes

Diagnostic step 1

Collect kerberos and security event logs from the host and the file server for the task execution timestamps to confirm authentication errors (Event IDs 4768/4771/4624).

Diagnostic step 2

Temporarily change task to run under a dedicated domain service account with minimal rights (already known to work) as a mitigation while diagnosing.

Diagnostic step 3

Attempt a controlled machine account reset: unjoin the host from domain (note: requires maintenance window), reboot, rejoin to domain and verify scheduled task behavior; document changes to allow rollback.