HOTSPOT
You are designing a monitoring solution to log performance for servers that run Windows Server
2008 R2. The monitoring solution must allow members of the Performance Log Users group to
create and modify Data Collector Sets. You need to grant members of the Performance Log Users
group the necessary permissions. Which User Rights Assignment policy should you configure?
To answer, select the appropriate User Rights Assignment policy in the answer area.
Answer: 
Explanation:
Log on as a batch job
http ://technet.microsoft.com/en-us/library/dd349804%28v=ws.10%29.aspx#BKMK_30
This policy setting determines which accounts can log on by using a batch-queue tool such as the
Task Scheduler service. When an administrator uses the Add Scheduled Task wizard to schedule a
task to run under a particular user name and password, that user is automatically assigned the Log
on as a batch job user right. When the scheduled time arrives, the Task Scheduler service logs the
user on as a batch job instead of as an interactive user, and the task runs in the user’s security
context.
Possible values:
User-defined list of accounts
Not Defined
Vulnerability
The Log on as a batch job user right presents a low-risk vulnerability. For most organizations, the
default setting of Not Defined is sufficient. Members of the local Administrators group have this right
by default.
Countermeasure
You should allow the computer to manage this logon right automatically if you want to allow
scheduled tasks to run for specific user accounts. If you do not want to use the Task Scheduler in this
manner, configure the Log on as a batch job user right for only the Local Service account.
For IIS servers, you should configure this policy locally instead of through domain–based Group
Policy settings so that you can ensure that the local IUSR_<ComputerName> and
IWAM_<ComputerName> accounts have this logon right.
Potential impact
If you configure the Log on as a batch job setting by using domain-based Group Policy settings, the
computer cannot assign the user right to accounts that are used for scheduled jobs in the Task
Scheduler. If you install optional components such as ASP.NET or IIS, you may need to assign this
user right to additional accounts that are required by those components. For example, IIS requires
assignment of this user right to the IIS_WPG group and the IUSR_<ComputerName>, ASPNET, and
IWAM_<ComputerName> accounts. If this user right is not assigned to this group and these
accounts, IIS cannot run some COM objects that are necessary for proper functionality.