1
Diagnostic step 1
Collect kerberos and security event logs from the host and the file server for the task execution timestamps to confirm authentication errors (Event IDs 4768/4771/4624).
FULL AI ANALYSIS
Scheduled task runs interactively but fails under SYSTEM after domain migration with 'access denied' to network resource
Generated Oct 3, 2026, 12:35:03 AM
Analysis summary
The SYSTEM account authenticates to network resources using the machine account (host$). After AD migration, the machine account's credentials/SID history or the cross-domain trust state appears inconsistent; Kerberos requests during scheduled runs are failing while interactive runs use cached or different credential paths. Running the task under an explicit domain service account bypasses machine account authentication and works, which isolates the failure to machine-account-based network auth. Resetting the machine account and rejoining domain sometimes fixes this, but the observed SID history suggests leftover attributes from the previous domain causing Kerberos or NTLM mismatches.
Possible causes
Machine account credentials mismatch or stale SID history leftover from domain migration preventing Kerberos authentication for SYSTEM-based network access
85%SMB share configured to require Kerberos and machine account not trusted for delegation
80%Time skew or intermittent DC reachability at scheduled task time causing Kerberos failures
35%Group Policy or Local Security Policy restricting delegation or authentication protocols for computer accounts at scheduled times
25%Suggested fixes
2
Diagnostic step 2
Temporarily change task to run under a dedicated domain service account with minimal rights (already known to work) as a mitigation while diagnosing.
3
Diagnostic step 3
Attempt a controlled machine account reset: unjoin the host from domain (note: requires maintenance window), reboot, rejoin to domain and verify scheduled task behavior; document changes to allow rollback.
4
Diagnostic step 4
Verify time synchronization (w32tm /query /status) and that the host points to reachable domain controllers at the scheduled time.
5
Diagnostic step 5
If machine account reset is not permitted or problem persists after rejoin, escalate to AD administrators to inspect trust relationship and machine-account attributes; avoid storing admin passwords in scripts and do not delete AD objects without team approval.