Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a way to know the source and legitimacy of the tasks in the task scheduler in windows server 2008 and 2003? Can I check if the task was added by Microsoft (ie: from sccm) or by a 3rd party application?

For each task in the task scheduler, I want to verify that the task has not been created by a third party application. I only want to allow standards Microsoft Tasks and disable all other non-standards tasks.

I have created a PowerShell script that goes through all the xml files in the C:\Windows\System32\Tasks directory and I was able to read all the xml task files successfully but I am stuck on how to validate the tasks.

Here is the script for your reference:

Function TaskSniper()
{
   #Getting all the fils in the Tasks folder
   $files = Get-ChildItem "C:\Windows\System32\Tasks" -Recurse | Where-Object {!$_.PSIsContainer};
   [Xml] $StandardXmlFile = Get-Content "Edit Me";

   foreach($file in $files)
   {
       #constructing the file path
       $path = $file.DirectoryName + "\" + $file.Name 

       #reading the file as an XML doc
       [Xml] $xmlFile = Get-Content $path


       #DS SEE: http://social.technet.microsoft.com/Forums/en-US/w7itprogeneral/thread/caa8422f-6397-4510-ba6e-e28f2d2ee0d2/
       #(get-authenticodesignature C:\Windows\System32\appidpolicyconverter.exe).status -eq "valid"

       #Display something
       $xmlFile.Task.Settings.Hidden

   }

}
share|improve this question

1 Answer 1

Legitimacy sounds vague.

If by source you are referring to the Author, that is available in the Principals node:

$xmlFile.Task.Principals.ChildNodes

id                                      GroupId                                 RunLevel
--                                      -------                                 --------
Author                                  S-1-5-32-545                            LeastPrivilege

An alternative approach may be to audit when and who creates a scheduled task. Hera are the Security event id's for Windows 2008 R2:

4698    A scheduled task was created.
4700    A scheduled task was enabled.
4702    A scheduled task was updated.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.