(Oops I asked this on SuperUser first on accident...)

I am trying to find out if someone added a new Scheduled Task to a Windows 2003 Server. How can I find the date a scheduled task was actually created? Exploring Scheduled Tasks in Explorer doesn't show Created or Modified as a column value.

Thanks in advance for any help!


The quickest way I can think of to show the creation time on a "Scheduled Task" entry would be to execute:

attrib -r -s -h %SystemRoot%\Tasks\Desktop.ini
ren %SystemRoot%\Tasks\Desktop.ini Desktop.ini.foo
explorer %SystemRoot%\Tasks

This would open the %SystemRoot%\Tasks folder in a "normal" Explorer view and would let you review the times on the files stored there.

When you're done, rename and re-apply attributes to "desktop.ini" to make things normal again:

ren %SystemRoot%\Tasks\Desktop.ini.foo Desktop.ini
attrib +r +s +h %SystemRoot%\Tasks\Desktop.ini

It's a cheap trick, but it should show you the creation time on the task file for the task you're interested in.


dir /t:c %systemroot%\Tasks\"taskname".job

  • RE: Maxwell, the api you are referring to is only availabe in VISTA and Server 2008 – Anonymous Dec 15 '09 at 17:41

Use this link...


Schtasks /Query

  • Thanks Anand for the input. I didn't know about this tool, so thanks! Using it though, even w/the /v option, I didn't see Created or Creation Date as a listed property/attribute. Am I just not seeing it for some reason? – user27933 Dec 3 '09 at 5:03
  • schtasks /v shows you the "starting on xx/xx/20xx etc. – JJJJNR Jan 27 '14 at 12:24

You can work out a vbscript to query the values form the RegistrationInfo Object. It will provide you the date where the task was registered. Here 's link to the MSDN library covering Task Scheduler Scripting.

Hope this helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.