Event ID 4700 — A scheduled task was enabled.

Provider: Microsoft-Windows-Security-Auditing
Channel: Security
Audit Policy: Object Access → Other Object Access Events
Collection Priority: Recommended (Palantir, others)
Opcode: Info

Description

A scheduled task was enabled.

Message #

A scheduled task was enabled.

Subject:
	Security ID: %1
	Account Name: %2
	Account Domain: %3
	Logon ID: %4

Task Information:
	Task Name: %5
	Task Content: %6

Fields #

Name	Description
`SubjectUserSid` SID	[Subject] Security ID
`SubjectUserName` UnicodeString	[Subject] Account Name
`SubjectDomainName` UnicodeString	[Subject] Account Domain
`SubjectLogonId` HexInt64	[Subject] Logon ID
`TaskName` UnicodeString	[Task Information] Task Name
`TaskContent` UnicodeString	[Task Information] Task Content
`ClientProcessStartKey` UInt64	[Other Information] ProcessCreationTime
`ClientProcessId` UInt32	[Other Information] ClientProcessId
`ParentProcessId` UInt32	[Other Information] ParentProcessId
`RpcCallClientLocality` UInt32	[Other Information] FQDN
`FQDN` UnicodeString	—
`Security_ID`	[Subject] Security ID.
`Account_Name`	[Subject] Account Name.
`Account_Domain`	[Subject] Account Domain.
`Logon_ID`	[Subject] Logon ID.
`Task_Name`	[Task Information] Task Name.
`Task_Content`	[Task Information] Task Content.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-Auditing",
    "guid": "54849625-5478-4994-A5BA-3E3B0328C30D",
    "event_source_name": "",
    "event_id": 4700,
    "version": 1,
    "level": 0,
    "task": 12804,
    "opcode": 0,
    "keywords": 9232379236109516800,
    "time_created": "2026-03-08T23:13:42.036906+00:00",
    "event_record_id": 1552683,
    "correlation": {
      "ActivityID": "0973643C-548D-4680-AA95-124DB4FF8472"
    },
    "execution": {
      "process_id": 780,
      "thread_id": 2440
    },
    "channel": "Security",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "SubjectUserSid": "S-1-5-20",
    "SubjectUserName": "LAB-WIN11$",
    "SubjectDomainName": "ludus",
    "SubjectLogonId": "0x3e4",
    "TaskName": "\\Microsoft\\Windows\\SoftwareProtectionPlatform\\SvcRestartTaskLogon",
    "TaskContent": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n  <RegistrationInfo>\r\n    <Version>1.0</Version>\r\n    <SecurityDescriptor>D:P(A;;FA;;;SY)(A;;FA;;;BA)(A;;FRFW;;;S-1-5-80-123231216-2592883651-3715271367-3753151631-4175906628)(A;;FR;;;S-1-5-4)</SecurityDescriptor>\r\n    <Source>$(@%systemroot%\\system32\\sppc.dll,-200)</Source>\r\n    <Author>$(@%systemroot%\\system32\\sppc.dll,-200)</Author>\r\n    <Description>$(@%systemroot%\\system32\\sppc.dll,-202)</Description>\r\n    <URI>\\Microsoft\\Windows\\SoftwareProtectionPlatform\\SvcRestartTaskLogon</URI>\r\n  </RegistrationInfo>\r\n  <Principals>\r\n    <Principal id=\"InteractiveUser\">\r\n      <GroupId>S-1-5-4</GroupId>\r\n    </Principal>\r\n  </Principals>\r\n  <Settings>\r\n    <AllowHardTerminate>false</AllowHardTerminate>\r\n    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n    <Hidden>true</Hidden>\r\n    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>\r\n    <RestartOnFailure>\r\n      <Count>3</Count>\r\n      <Interval>PT1M</Interval>\r\n    </RestartOnFailure>\r\n    <IdleSettings>\r\n      <StopOnIdleEnd>true</StopOnIdleEnd>\r\n      <RestartOnIdle>false</RestartOnIdle>\r\n    </IdleSettings>\r\n    <UseUnifiedSchedulingEngine>true</UseUnifiedSchedulingEngine>\r\n  </Settings>\r\n  <Triggers>\r\n    <LogonTrigger />\r\n  </Triggers>\r\n  <Actions Context=\"InteractiveUser\">\r\n    <ComHandler>\r\n      <ClassId>{B1AEBB5D-EAD9-4476-B375-9C3ED9F32AFC}</ClassId>\r\n      <Data><![CDATA[logon]]></Data>\r\n    </ComHandler>\r\n  </Actions>\r\n</Task>",
    "ClientProcessStartKey": 1970324836977758,
    "ClientProcessId": 5592,
    "ParentProcessId": 204,
    "RpcCallClientLocality": 0,
    "FQDN": "LAB-WIN11.ludus.domain"
  },
  "message": ""
}