Watch Out for Possible Problems with Task Scheduler, Cacls, and Xcacls

For some time, I've been testing my scripts to ensure that they'll function correctly in Windows 2000. When I recently tested a few scripts on a server running Win2K Server Service Pack 1 (SP1), I ran into problems with three commonly used tools: Task Scheduler, Cacls, and Xcacls. Here are the details about those problems and the Microsoft hotfixes available to fix them.

The Task Scheduler Problems
If you schedule any scripts or tasks to run with the Task Scheduler (mstask.exe) in Microsoft Internet Explorer (IE) 5.0, your scripts or tasks might fail to run when scheduled or they might become hung in the Running state, as indicated on the Task Scheduler's GUI. These problems can occur if you're using IE 5.0's Task Scheduler on a server running Win2K Server, Windows NT Server 4.0, or Microsoft BackOffice Server 4.0. You need to watch for these symptoms:

To get the Task Scheduler to work again, you need to stop and restart the service. However, when I stopped and restarted it, the condition cleared only temporarily. Examination of the Task Scheduler logs didn't reveal any cause for these problems. The logs just showed the start time and the end time for when I stopped and restarted the service.

For more information about the Task Scheduler problems, see the Microsoft article "Mstask.exe Does Not Run Scheduled Jobs". On Microsoft TechNet, this article's ID number is Q272022.

The Cacls and Xcacls Problems
Win2K's Cacls command and the Microsoft Windows 2000 (Server or Professional) Resource Kit's Xcacls utility can potentially destroy permissions on file and folder structures. I recently attempted to use a script to modify permissions on Win2K Server. The script uses Win2K's Cacls command and the resource kit's Xcacls utility to remove permissions for one group and grant permissions to two other groups in several files and system folders. However, Cacls and Xcacls didn't apply the new permissions correctly, and they completely lost the old permissions. The final result was that the file and folder permissions became corrupted and defaulted to giving everyone Full Control permissions.

According to Microsoft, the problem lies in the ordering of the access control entries (ACEs). For more information about this problem, see the Microsoft article "Cacls.exe Orders ACEs Incorrectly When Granting Rights". On Microsoft TechNet, this article's ID number is Q268546.

Hotfixes Are Available
Hotfixes are available for Task Scheduler and Cacls but not Xcacls. (Because Xcacls is a resource kit utility, the corrected version will probably appear in a future resource kit supplement.) To solve the Task Scheduler and Cacls problems, you can obtain new versions of mstask.exe and cacls.exe, respectively. You need to contact Microsoft Product Support Services (PSS) at 800-936-4900 for these hotfixes. If you refer to the TechNet article ID numbers, PSS provides these hotfixes at no charge. PSS will give you an FTP download location and a password to open the self-extracting executable that contains the new files and the hotfix installer. However, these hotfixes aren't fully regression tested, so you'll need to evaluate them in a test environment before deploying them on production servers.