0

(Oops I asked this on SuperUser first on accident...)

I am trying to find out if someone added a new Scheduled Task to a Windows 2003 Server. How can I find the date a scheduled task was actually created? Exploring Scheduled Tasks in Explorer doesn't show Created or Modified as a column value.

Thanks in advance for any help!

4 Answers 4

2

The quickest way I can think of to show the creation time on a "Scheduled Task" entry would be to execute:

attrib -r -s -h %SystemRoot%\Tasks\Desktop.ini
ren %SystemRoot%\Tasks\Desktop.ini Desktop.ini.foo
explorer %SystemRoot%\Tasks

This would open the %SystemRoot%\Tasks folder in a "normal" Explorer view and would let you review the times on the files stored there.

When you're done, rename and re-apply attributes to "desktop.ini" to make things normal again:

ren %SystemRoot%\Tasks\Desktop.ini.foo Desktop.ini
attrib +r +s +h %SystemRoot%\Tasks\Desktop.ini

It's a cheap trick, but it should show you the creation time on the task file for the task you're interested in.

1

dir /t:c %systemroot%\Tasks\"taskname".job

1
  • RE: Maxwell, the api you are referring to is only availabe in VISTA and Server 2008
    – Anonymous
    Dec 15, 2009 at 17:41
1

Use this link...

http://support.microsoft.com/kb/814596

Schtasks /Query

2
  • Thanks Anand for the input. I didn't know about this tool, so thanks! Using it though, even w/the /v option, I didn't see Created or Creation Date as a listed property/attribute. Am I just not seeing it for some reason?
    – user27933
    Dec 3, 2009 at 5:03
  • schtasks /v shows you the "starting on xx/xx/20xx etc.
    – JJJJNR
    Jan 27, 2014 at 12:24
0

You can work out a vbscript to query the values form the RegistrationInfo Object. It will provide you the date where the task was registered. Here 's link to the MSDN library covering Task Scheduler Scripting.

Hope this helps.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .