Event ID 4701 — A scheduled task was disabled.

Provider: Microsoft-Windows-Security-Auditing
Channel: Security
Audit Policy: Object Access → Other Object Access Events
Collection Priority: Recommended (Palantir, others)
Opcode: Info

Description

A scheduled task was disabled.

Message #

A scheduled task was disabled.

Subject:
	Security ID: %1
	Account Name: %2
	Account Domain: %3
	Logon ID: %4

Task Information:
	Task Name: %5
	Task Content: %6

Fields #

Name	Description
`SubjectUserSid` SID	[Subject] Security ID
`SubjectUserName` UnicodeString	[Subject] Account Name
`SubjectDomainName` UnicodeString	[Subject] Account Domain
`SubjectLogonId` HexInt64	[Subject] Logon ID
`TaskName` UnicodeString	[Task Information] Task Name
`TaskContent` UnicodeString	[Task Information] Task Content
`ClientProcessStartKey` UInt64	[Other Information] ProcessCreationTime
`ClientProcessId` UInt32	[Other Information] ClientProcessId
`ParentProcessId` UInt32	[Other Information] ParentProcessId
`RpcCallClientLocality` UInt32	[Other Information] FQDN
`FQDN` UnicodeString	—
`Security_ID`	[Subject] Security ID.
`Account_Name`	[Subject] Account Name.
`Account_Domain`	[Subject] Account Domain.
`Logon_ID`	[Subject] Logon ID.
`Task_Name`	[Task Information] Task Name.
`Task_Content`	[Task Information] Task Content.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-Auditing",
    "guid": "54849625-5478-4994-A5BA-3E3B0328C30D",
    "event_source_name": "",
    "event_id": 4701,
    "version": 1,
    "level": 0,
    "task": 12804,
    "opcode": 0,
    "keywords": 9232379236109516800,
    "time_created": "2026-03-09T18:21:07.550543+00:00",
    "event_record_id": 1753741,
    "correlation": {
      "ActivityID": "B6034439-245E-4C44-9C16-887F1090313D"
    },
    "execution": {
      "process_id": 8,
      "thread_id": 6100
    },
    "channel": "Security",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "SubjectUserSid": "S-1-5-18",
    "SubjectUserName": "LAB-WIN11$",
    "SubjectDomainName": "WORKGROUP",
    "SubjectLogonId": "0x3e7",
    "TaskName": "\\Microsoft\\Windows\\EnterpriseMgmt\\69C01DBD-8068-44F9-9507-8A9DF76C127A\\Wsc Startup event listener created by enrollment client",
    "TaskContent": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.4\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n  <RegistrationInfo>\r\n    <SecurityDescriptor>D:P(A;;FA;;;BA)(A;;FA;;;SY)(A;;FRFX;;;LS)</SecurityDescriptor>\r\n    <Author>Microsoft Corporation</Author>\r\n    <URI>\\Microsoft\\Windows\\EnterpriseMgmt\\69C01DBD-8068-44F9-9507-8A9DF76C127A\\Wsc Startup event listener created by enrollment client</URI>\r\n  </RegistrationInfo>\r\n  <Principals>\r\n    <Principal id=\"LocalSystem\">\r\n      <UserId>S-1-5-18</UserId>\r\n      <RunLevel>HighestAvailable</RunLevel>\r\n    </Principal>\r\n  </Principals>\r\n  <Settings>\r\n    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n    <Enabled>false</Enabled>\r\n    <ExecutionTimeLimit>PT1H</ExecutionTimeLimit>\r\n    <MultipleInstancesPolicy>Queue</MultipleInstancesPolicy>\r\n    <RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable>\r\n    <IdleSettings>\r\n      <StopOnIdleEnd>false</StopOnIdleEnd>\r\n      <RestartOnIdle>false</RestartOnIdle>\r\n    </IdleSettings>\r\n    <UseUnifiedSchedulingEngine>true</UseUnifiedSchedulingEngine>\r\n  </Settings>\r\n  <Triggers>\r\n    <WnfStateChangeTrigger>\r\n      <StateName>7510BCA33A1D8541</StateName>\r\n    </WnfStateChangeTrigger>\r\n  </Triggers>\r\n  <Actions Context=\"LocalSystem\">\r\n    <Exec>\r\n      <Command>%windir%\\system32\\deviceenroller.exe</Command>\r\n      <Arguments>/s \"69C01DBD-8068-44F9-9507-8A9DF76C127A\" /c /WscStartupAlert</Arguments>\r\n    </Exec>\r\n  </Actions>\r\n</Task>",
    "ClientProcessStartKey": 3940649673950061,
    "ClientProcessId": 9152,
    "ParentProcessId": 840,
    "RpcCallClientLocality": 0,
    "FQDN": "LAB-WIN11"
  },
  "message": ""
}