We have several scheduled tasks setup to run under a service account. We had a few incidents where the tasks have been triggered manually by a user. Looking at the history of the task it does not appear there is a way to determine the user that triggered the task. Under the Task Category it just states "Task triggered by user" and under the User column it just lists SYSTEM.

Is there anyway for me to determine exactly who executed a scheduled task?

We are running 2008 R2. Thank you in advance!

1 Answer 1


A partial solution, assuming you are referring to a local user. You could try setting auditing access to "schtasks" command if you have a common group for all users just to see if it is being triggered by that method. It would help eliminate one possible method.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.