Hi,

Some time ago, I made a ps1 script that leverages excel COM libraries and excel process operations in 2 major ways. (details below)

I configured a scheduled task to execute this script non-interactively as a standard user in a Windows Server 2022 environment.

Long story short, everything was working fine until the domain account this script was running under got deleted, and as you may imagine the provisioning process for a new account can take some time. 

In order to circumvent this and also prevent this kind of issue from reappearing in the future i would like to run it as a local standard account with no more privilege than required for obvious security reasons.

It appears this is a tidy bit more complex than what i’ve imagined.

Below is the stacktrace for each operation.

1/ Stopping all excel processes 

Stop-Process: C:XXXXXXXXX.ps1:28
Line |
28 | get-process *excel* | stop-process -force
| ~~~~~~~~~~~~~~~~~~~
| Cannot stop process “EXCEL (2632)” because of the following error: Access is denied.

2/ Creating an instance of Excel.Application COM class object

PS>TerminatingError(New-Object): “Retrieving the COM class factory for component with CLSID {00024500-0000-0000-C000-000000000046} failed due to the following error: 80070005 Access is denied. (0x80070005 (E_ACCESSDENIED)).”
New-Object: C:XXXXXXXXX.ps1:29
Line |
29 | $excel_input = New-Object -ComObject Excel.Application

As you can see, both operations are blocked for permission issues, despite having taken all the steps below to address it :

1/ Assigned all DCOM permissions to local account for Excel Application

2/ Added local account to local Distributed COM Users group

3/ Set registry key HKEY_LOCAL_MACHINESOFTWAREClassesAppID{00020812-0000-0000-C000-000000000046} to run as “Interactive User”

4/ Assign full control over root script folder to local account 

5/ Assign full control over Excel.exe to local account

When adding this local account to local Administrators group, the errors disappear, but this is obviously not a solution, just a sanity check.

Which leads to my final question : What are the minimally required permissions to run excel operations as a scheduled task ?

Any suggestion would be greatly appreciated,

Thank you, 

​Hi, Some time ago, I made a ps1 script that leverages excel COM libraries and excel process operations in 2 major ways. (details below)I configured a scheduled task to execute this script non-interactively as a standard user in a Windows Server 2022 environment.Long story short, everything was working fine until the domain account this script was running under got deleted, and as you may imagine the provisioning process for a new account can take some time.  In order to circumvent this and also prevent this kind of issue from reappearing in the future i would like to run it as a local standard account with no more privilege than required for obvious security reasons. It appears this is a tidy bit more complex than what i’ve imagined. Below is the stacktrace for each operation. 1/ Stopping all excel processes Stop-Process: C:XXXXXXXXX.ps1:28
Line |
28 | get-process *excel* | stop-process -force
| ~~~~~~~~~~~~~~~~~~~
| Cannot stop process “EXCEL (2632)” because of the following error: Access is denied.2/ Creating an instance of Excel.Application COM class objectPS>TerminatingError(New-Object): “Retrieving the COM class factory for component with CLSID {00024500-0000-0000-C000-000000000046} failed due to the following error: 80070005 Access is denied. (0x80070005 (E_ACCESSDENIED)).”
New-Object: C:XXXXXXXXX.ps1:29
Line |
29 | $excel_input = New-Object -ComObject Excel.Application As you can see, both operations are blocked for permission issues, despite having taken all the steps below to address it : 1/ Assigned all DCOM permissions to local account for Excel Application2/ Added local account to local Distributed COM Users group3/ Set registry key HKEY_LOCAL_MACHINESOFTWAREClassesAppID{00020812-0000-0000-C000-000000000046} to run as “Interactive User”4/ Assign full control over root script folder to local account 5/ Assign full control over Excel.exe to local account When adding this local account to local Administrators group, the errors disappear, but this is obviously not a solution, just a sanity check. Which leads to my final question : What are the minimally required permissions to run excel operations as a scheduled task ? Any suggestion would be greatly appreciated,Thank you,    Read More

​