title: Group Managed Service Accounts - issues with Powershell commands when run in scheduled tasks
body: <p>I've been looking into <a href="https://technet.microsoft.com/en-us/library/hh831782(v=ws.11).aspx" rel="nofollow noreferrer">Group Managed Service Accounts</a> (gmsa) accounts and I've been using them to run scheduled tasks on Server 2012R2 and PowerShell 5.0.10586.117.</p>
  
  <p>After I've been using them a while I've encountered some very weird behavior.</p>
  
  <p>The problem seem to be some kind of timing issue/race condition somewhere when a task is run as a gmsa account. Some core commands might not exists/be loaded while running the script.</p>
  
  <p>Example:</p>
  
  <p>Script called in the task <code>C:\temp\broken-task\test.cmd</code></p>
  
  <pre><code>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy "ByPass" -File "C:\temp\broken-task\test.ps1" &gt; "C:\temp\broken-task\test.cmd.txt"
  </code></pre>
  
  <p>The actual script with weird behavior <code>C:\temp\broken-task\test.ps1</code></p>
  
  <pre><code>&lt;#
  
  .SYNOPSIS
  Broken task.
  
  .DESCRIPTION
  Broken task.
  
  #&gt;
  
  [CmdletBinding()] Param ()
  
  Process {
      $ErrorActionPreference
      Set-Variable -Name "ErrorActionPreference" -Scope "Script" -Value "Stop"
      Set-Variable -Name "ErrorActionPreference" -Scope "Script" -Value "Stop"
      $ErrorActionPreference
  }
  </code></pre>
  
  <p>I then create and run a task in <code>C:\temp\broken-task\task.ps1</code></p>
  
  <pre><code>$Action = New-ScheduledTaskAction -Execute "C:\Windows\System32\cmd.exe" -Argument "/C C:\temp\broken-task\test.cmd"
  $Principal = New-ScheduledTaskPrincipal -UserID "my-gmsa-user$" -LogonType "Password"
  New-ScheduledTask -Action $Action -Principal $Principal | Register-ScheduledTask -TaskPath "\test\" -TaskName "test123" | Out-Null
  Start-ScheduledTask -TaskPath "\test\" -TaskName "test123"
  </code></pre>
  
  <p>After task completion the content of <code>C:\temp\broken-task\test.cmd.txt</code> is the following:</p>
  
  <pre><code>Continue
  Set-Variable : The term 'Set-Variable' is not recognized as the name of a cmdle
  t, function, script file, or operable program. Check the spelling of the name, 
  or if a path was included, verify that the path is correct and try again.
  At C:\temp\broken-task\test.ps1:15 char:5
  +     Set-Variable -Name "ErrorActionPreference" -Scope "Script" -Value ...
  +     ~~~~~~~~~~~~
      + CategoryInfo          : ObjectNotFound: (Set-Variable:String) [], Comman 
     dNotFoundException
      + FullyQualifiedErrorId : CommandNotFoundException
  
  Stop
  </code></pre>
  
  <p>What is happening above is that <code>Set-Variable</code> doesn't exist on line 2 of the process block in <code>test.ps1</code>, but exist on line 3 (we can see that <code>$ErrorActionPreference</code> has changed).</p>
  
  <p>If I run either the cmd script or the ps1 as myself (a normal user) I will get the expected output with no errors:</p>
  
  <pre><code>Continue
  Stop
  </code></pre>
  
  <p>So what's going on here? The <code>Set-Variable</code> command is in the <code>Microsoft.PowerShell.Utility</code> module. Is the module somehow loaded in between the first and second call? This also happen with other commands like <code>Get-Item "C:\"</code>.</p>
  
  <p>What might be even worse is that this does not always happen. I've seen a task work properly in one run and fail in the other.</p>
  
  <p>Also note that I find it hard to create good examples and this does not always yield the same weird results (but the above example has currently failed without exception in my tests).</p>
  
  <p>Is the combination of powershell, gmsa and task scheduler broken somehow?</p>
  
  <p>I can't really trust the system to do as I which when it has this inconsistent behavior.</p>
  
  <p>A workaround <em>might</em> be explicit loading of the <code>Microsoft.PowerShell.Utility</code> module before calling <code>Set-Variable</code>, but I'm not sure if this is due to timing or something else..</p>