---
title: Using exec tasks
description: Exec tasks allow administrators and external users to execute a specified command on the server once or as recurring tasks.
component: pingdirectory
version: 11.0
page_id: pingdirectory:pingdirectory_server_administration_guide:pd_ds_use_exec_tasks
canonical_url: https://docs.pingidentity.com/pingdirectory/11.0/pingdirectory_server_administration_guide/pd_ds_use_exec_tasks.html
revdate: September 13, 2023
section_ids:
  about-this-task: About this task
  steps: Steps
  example: Example:
---

# Using exec tasks

Exec tasks allow administrators and external users to execute a specified command on the server once or as recurring tasks.

## About this task

The server restricts the kinds of commands that can be executed, and the access level of users who can execute them.

These safeguards and requirements include:

* The absolute path to the command to execute must be listed in the `<server-root>/config/exec-command-whitelist.txt` file.

* The global configuration must be updated to allow the exec task. The server does not permit it by default. The following command enables this.

  ```shell
  $ bin/dsconfig set-global-configuration-prop \
    --add allowed-task:com.unboundid.directory.server.tasks.ExecTask
  ```

* The user scheduling the task must have the `exec-task` privilege. The server does not grant permission to run this task to any user by default, including root users.

The following configuration changes grant the `exec-task` privilege to a single root user, all root users, or a single non-root user:

## Steps

* To grant the `exec-task` privilege to a single root user, run the following.

  ```shell
  $ bin/dsconfig set-root-dn-user-prop --user-name "<username>" \
    --add privilege:exec-task
  ```

* To grant the `exec-task` privilege to all root users, run the following.

  ```shell
  $ bin/dsconfig set-root-dn-prop \
    --add default-root-privilege-name:exec-task
  ```

* To grant the `exec-task` privilege to a single non-root user, run the following.

  ```
  dn:  <userdn>
  changetype: modify
  add: ds-privilege-name
  ds-privilege-name: exec-task
  ```

* Use the `schedule-exec-task` tool to create an exec task from the command line.

  ### Example:

  The following command schedules an exec task to run the `verify-index` tool to check the integrity of the `cn` index in the backend that hosts `"dc=example,dc=com"`, assuming that the server is installed in `/ds`.

  ```shell
  $ bin/schedule-exec-task --hostname directory.example.com \
    --port 389 \
    --bindDN uid=admin,dc=example,dc=com \
    --promptForBindPassword \
    --waitForCompletion \
    --logCommandOutput \
    /ds/bin/verify-index --baseDN dc=example,dc=com --index cn
  ```