(imported topic written by SystemAdmin)
I’m trying to get information from all Scheduled tasks, I heard there was a new Scheduled task inspector coming out soon…
in the mean time I looking for information like who the task “runs as”, because were changing passwords and I need to see if there are any tasks running as that user
when I use WMI it only seems to gather information on AT commands and not standard tasks
Im running Client version 7.2.5.22 and the latest server and consoles
(imported comment written by MattBoyd)
I’ve got some bad news… it can’t be done with relevance alone. In fact, there is no way to query these values in Windows without using a VBScript (beginning with Windows Vista) or the schtasks Command Line utility.
More info: http://www.microsoft.com/technet/scriptcenter/resources/qanda/sept04/hey0922.mspx
You could create a BigFix task that outputs the results of an schtasks /Query command to a text file. You could then use relevance to parse that text file. It’s not elegant, but it should work.
(imported comment written by SystemAdmin)
This is a bit ghetto, but one thing I do is I create the scheduled task with BigFix and give it a name with the date in it. The relevance for the task has that file name, so it knows not run again on that machine. If I want to go back and change it, I just kill that schedule task and create a new one with a new BigFix task. Obviously this doesn’t help if you already have existing tasks out there that you want to inspect-- Boyd’s suggestion would be your best bet then.
(imported comment written by SystemAdmin)
I found how to query for “Run as” with the command below
now I just need to figure out how to parse the line out
schtasks /query /FO LIST /V
HostName:
SERVER01
TaskName: Mozilla Firefox
Next Run Time: 14:38:00, 2/9/2010
Status:
Last Run Time: Never
Last Result: 0
Creator: markm
Schedule: At 2:38 PM every Tue of every week, starti
ng 2/2/2010
Task To Run: C:\PROGRA~1\MOZILL~1\firefox.exe
Start In: C:\PROGRA~1\MOZILL~1
Comment: N/A
Scheduled Task State: Enabled
Scheduled Type: Weekly
Start Time: 14:38:00
Start Date: 2/2/2010
End Date: N/A
Days: TUESDAY
Months: N/A
Run As User:
MYDOMAIN\administrator
Delete Task If Not Rescheduled: Disabled
Stop Task If Runs X Hours and X Mins: 72:0
Repeat: Every: Disabled
Repeat: Until: Time: Disabled
Repeat: Until: Duration: Disabled
Repeat: Stop If Still Running: Disabled
Idle Time: Disabled
Power Management: No Start On Batteries, Stop On Battery Mode
schtasks /query /FO TABLE /V
or
schtasks /query /V
gives you the same information but 1 task per line
(imported comment written by MattBoyd)
(it as trimmed string) of (following texts of firsts ":" of it) of (lines starting with "Run As User:" of file "yourschtasksresult.txt")
Just change “yourschtasksresult.txt” to whatever file you’re piping the schtasks output to.
(imported comment written by SystemAdmin)
what i am doing is using a task to run the schtasks.exe and then gather the results in an analysis
I also had to modify a copy of the schtasks.exe from XP sp3 and modified it using the link below
to get the same results on Windows 2000, because 2000 does not have schtasks, and the one from XP only works on XP and 2003
if
{(not exists (pathname of windows folder &
"\System32\schtasks.exe")) and (not exists (name of drive of windows folder &
"\Program Files\Resource Kit\schtasks.exe"))
} prefetch schtasks.exe sha1:e1643645db2c6a17685a8c3e9763100911c8e398 size:121856 http:
//MYBESSERVER.COM/Shared/Component_Install/SCHTASKS_Win_2000/schtasks.exe copy __download\schtasks.exe
{pathname of windows folder
}\System32\schtasks.exe endif DOS
{pathname of windows folder
}\System32\SCHTASKS.EXE /QUERY /FO CSV /V >
{pathname of windows folder
}\SCHTASKS.TXT
than gather it with a analysis
(All tasks run as 1 user account)
if exists file ((pathname of windows folder) &
"\SCHTASKS.TXT") then lines whose (it as lowercase contains
"<YOUR USER>") of file ((pathname of windows folder) &
"\SCHTASKS.TXT")
else
"<Tasks not available>"
(All Tasks)
if exists file ((pathname of windows folder) &
"\SCHTASKS.TXT") then lines whose (it contains computer name) of file ((pathname of windows folder) &
"\SCHTASKS.TXT")
else
"<Tasks not available>"
this way if he file is not present it displays “” and if its empty it displays “”
otherwise it displays a comma delimited list of all tasks
(imported comment written by NoahSalzman)
There is a new Scheduled Task inspector in v8.0.
Some examples here.