Service account permissions for Windows jobs in Autosys Workload Automation

Products

• Autosys Workload Automation
• Workload Automation Agent

Issue/Introduction

This article clarifies the required Windows user rights for service accounts used to execute jobs via the Autosys Windows Agent.
It explains why a broad set of permissions is typically documented and how to determine the minimum permissions required for specific job types.

Environment

• Product: Autosys Workload Automation
• Component: Windows Agent
• Platform: Microsoft Windows Server (All Supported Versions)

Cause

Customers often require a "least privilege" security model for service accounts.
The standard documentation provides a comprehensive list of permissions to cover all possible job types (interactive, file transfer, command, etc.), which may include sensitive rights that trigger security audits.

Resolution

Understanding the Permission List

The permissions documented in the List of Required Permissions to Run a Job on Windows present a combined set of rights. Not every permission is required for every job.

• Administrative Rights: Certain rights, such as SeTcbPrivilege (Act as part of the operating system), are more sensitive than standard local administrator rights. Windows requires these to be explicitly granted.
• Job-Specific Needs: A simple command job requires fewer rights than an interactive job or a job that must impersonate another user.

Best Practice: Iterative Testing for Least Privilege

To determine the minimum required permissions for your specific environment and job types, follow these steps:

1. Start with a Minimum Set: Remove permissions that are not strictly necessary for the job type (e.g., remove interactive login rights if the job is a background command).
2. Execute a Test Job: Run the job through the Autosys Agent.
3. Analyze Failures: If the job fails with an error (e.g., The user name or password is incorrect or Access Denied), review the Agent logs.
4. Incrementally Add Rights: Re-add a single permission and re-test until the job completes successfully.

Additional Information

To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on the respective region.