Our C# application has a feature that uses the ITaskFolder and ITaskDefinition (see: https://learn.microsoft.com/en-us/windows/win32/api/taskschd/nf-taskschd-itaskfolder-registertaskdefinition) COM interfaces to automatically register a task. The use case is that the user provides their username and password, and the task is registered with the Run whether user is logged on or not logon option. This is accoplished like so: folder.RegisterTaskDefinition("task name", task, (int)_TASK_CREATION.TASK_CREATE_OR_UPDATE, username, password, _TASK_LOGON_TYPE.TASK_LOGON_PASSWORD, null). However, the issue I'm having is that this defaults to have the Do not store password. The task will only have access to local computer resources unchecked. This is fine in many cases, but this can be disallowed by the Network Access: Do not allow storage of passwords and credentials for network authentication security policy.
My question is simple: how can I set this checkbox to checked through the ITaskFolder interface during task registration? I've had a look at the task schema (https://learn.microsoft.com/en-us/windows/win32/taskschd/task-scheduler-schema) but I don't see an immediate way to check that box.
I set the task up the way I wanted, then used the same interfaces to inspect the XML. The only difference is the logon type: S4U instead of Password:
However, when I use _TASK_LOGON_TYPE.TASK_LOGON_S4U to register the task in the code, I get an access denied error. Also according to the documentation here, that doesn't like a complete solution anyway. Something else must be different as well
I'm answering my own question, because it seems that S4U requires admin privileges. So, running the application as admin resolves it. Not the answer I was hoping for, but at least I have it worked out.