detection.wiki

Microsoft-Windows-TaskScheduler

148 events across 5 channels

Event IDTitleChannel
100Task Scheduler started "UserContext" instance of the "Name" task for user …Operational
101Task Scheduler failed to start "Name" task for user "TaskName".Operational
102Task Scheduler successfully finished "UserContext" instance of the "Name" task …Operational
103Task Scheduler failed to start instance "TaskName" of "Name" task for user …Operational
104Task Scheduler failed to log on "UserName" .Operational
105Task Scheduler failed to impersonate "Context" .Operational
106User "TaskName" registered Task Scheduler task "Name".Operational
107Task Scheduler launched "TaskName" instance of task "Name" due to a time trigger …Operational
108Task Scheduler launched "TaskName" instance of task "Name" according to an event …Operational
109Task Scheduler launched "TaskName" instance of task "Name" according to a …Operational
110Task Scheduler launched "TaskName" instance of task "Name" for user "InstanceId" …Operational
111Task Scheduler terminated "TaskName" instance of the "Name" task.Operational
112Task Scheduler could not start task "TaskName" because the network was …Operational
113Task registered task "TaskName" , but not all specified triggers will start the …Operational
114Task Scheduler could not launch task "Name" as scheduled.Operational
115Task Scheduler failed to roll back a transaction when updating or deleting a …Operational
116Task Scheduler validated the configuration for task "TaskName" , but credentials …Operational
117Task Scheduler launched "InstanceId" instance of task "TaskName" due to an idle …Operational
118Task Scheduler launched "TaskName" instance of task "Name" due to system …Operational
119Task Scheduler launched "UserName" instance of task "Name" due to user …Operational
120Task Scheduler launched "InstanceId" instance of task "TaskName" due to user …Operational
121Task Scheduler launched "InstanceId" instance of task "TaskName" due to user …Operational
122Task Scheduler launched "InstanceId" instance of task "TaskName" due to user …Operational
123Task Scheduler launched "InstanceId" instance of task "TaskName" due to user …Operational
124Task Scheduler launched "InstanceId" instance of task "TaskName" due to user …Operational
125Task Scheduler launched "InstanceId" instance of task "TaskName" due to user …Operational
126Task Scheduler failed to execute task "TaskName" .Operational
127Task Scheduler failed to execute task "TaskName" due to a shutdown race …Operational
128Task Scheduler did not launch task "TaskName" , because current time exceeds the …Operational
129Task Scheduler launch task "Name" , instance "TaskName" with process ID Path.Operational
130Task Scheduler failed to start task "TaskName" due to the service being busy.Operational
131Task Scheduler failed to start task "TaskName" because the number of tasks in …Operational
132Task Scheduler task launching queue quota is approaching its preset limit of …Operational
133Task Scheduler failed to start task TaskName" in TaskEngine "TaskEngineName" for …Operational
134Task Engine "TaskEngineName" for user "UserName" is approaching its preset limit …Operational
135Task Scheduler could not start task "TaskName" because the machine was not idle.Operational
140User "TaskName" updated Task Scheduler task "Name".Operational
141User "TaskName" deleted Task Scheduler task "Name".Operational
142User "TaskName" disabled Task Scheduler task "Name".Operational
145Task Scheduler woke up the computer to run a task.Operational
146Task Scheduler failed to load task "TaskName" at service startup.Operational
147Task Scheduler recovered sucessfully the image of task "TaskName" after a …Operational
148Task Scheduler failed to recover the image of task "TaskName" after a corruption …Operational
149Task "TaskName" is using a combination of properties that is incompatible with …Operational
150Task Scheduler failed to subscribe for the event trigger for task "TaskName".Operational
151Task instantiation failed "TaskName".Operational
152Task "TaskName" was re-directed to legacy scheduling engine.Operational
153Task Scheduler did not launch task "Name" as it missed its schedule.Operational
155Task Scheduler is currently waiting on completion of task "TaskPath".Operational
200Task Scheduler launched action "TaskName" in instance "ActionName" of task …Operational
201Task Scheduler successfully completed task "Name" , instance "TaskInstanceId" , …Operational
202Task Scheduler failed to complete task "Name" , instance "TaskName" , action …Operational
203Task Scheduler failed to launch action "TaskInstanceId" in instance "TaskName" …Operational
204Task Scheduler failed to retrieve the event triggering values for task …Operational
205Task Scheduler failed to match the pattern of events for task "TaskName" .Operational
300Task Scheduler started Task Engine "TaskEngineName" with process ID ProcessID.Operational
301Task Scheduler is shutting down Task Engine "TaskEngineName".Operational
303Task Scheduler is shutting down Task Engine "TaskEngineName" due to an error in …Operational
304Task Scheduler sent "TaskName" task to Task Engine "TaskEngineName" .Operational
305Task Scheduler did not send "TaskName" task to Task Engine "TaskEngineName" .Operational
306For Task Scheduler Task Engine "TaskEngineName" , the thread pool failed to …Operational
307Task Scheduler service failed to connect to the Task Engine "TaskEngineName" …Operational
308Task Scheduler connected to the Task Engine "TaskEngineName" process.Operational
309Task Scheduler TaskCount tasks orphaned during Task Engine "TaskEngineName" …Operational
310Task Scheduler started Task Engine "TaskEngineName" process.Operational
311Task Scheduler failed to start Task Engine "TaskEngineName" process due to an …Operational
312Task Scheduler created the Win32 job object for Task Engine "TaskEngineName" .Operational
313Task Scheduler channel with Task Engine "TaskEngineName" is ready to send and …Operational
314Task Scheduler has no tasks running for Task Engine "TaskEngineName" , and the …Operational
315Task Engine "TaskEngineName" process failed to connect to the Task Scheduler …Operational
316Task Engine "TaskEngineName" failed to send a message to the Task Scheduler …Operational
317Task Scheduler started Task Engine "TaskEngineName" process.Operational
318Task Scheduler shutdown Task Engine "TaskEngineName" process.Operational
319Task Engine "TaskEngineName" received a message from Task Scheduler service …Operational
320Task Engine "TaskEngineName" received a message from Task Scheduler service …Operational
322Task Scheduler did not launch task "Name" because instance "TaskName" of the …Operational
323Task Scheduler stopped instance "StoppedTaskInstanceId" of task "TaskName" in …Operational
324Task Scheduler queued instance "TaskName" of task "Name" and will launch it as …Operational
325Task Scheduler queued instance "TaskName" of task "Name".Operational
326Task Scheduler did not launch task "TaskName" because computer is running on …Operational
327Task Scheduler stopped instance "TaskInstanceId" of task "TaskName" because the …Operational
328Task Scheduler stopped instance "TaskName" of task "Name" because computer is no …Operational
329Task Scheduler terminated "TaskName" instance of the "Name" task due to …Operational
330Task Scheduler stopped instance "TaskName" of task "Name" as request by user …Operational
331Task Scheduler will continue to execute Instance "TaskInstanceId" of task …Operational
332Task Scheduler did not launch task "Name" because user "TaskName" was not logged …Operational
333Task Scheduler did not launch task "TaskName" because target session is …Operational
334Task Scheduler did not launch task "TaskName" because target session is a WORKER …Operational
400Task Scheduler service has started.Operational
401Task Scheduler service failed to start due to an error in "ErrorDescription" .System
402Task Scheduler service is shutting down.Operational
403Task Scheduler service has encountered an error in "ErrorDescription" .Operational
404Task Scheduler service has encountered RPC initialization error in …System
405Task Scheduler service has failed to initialize COM.System
406Task Scheduler service failed to initialize credentials store.System
407Task Scheduler service failed to initialize LSA.System
408Task Scheduler service failed to initialize idle state detection module.System
409Task Scheduler service failed to initialize time change notification.System
410Task Scheduler service failed to set a wakeup timer.Operational
411Task Scheduler service received a time system change notification.Operational
412Task Scheduler service failed to launch tasks triggered by computer startup.System
413Task Scheduler service failed to load tasks at service startup.System
414Task Scheduler service found a misconfiguration in the TaskName definition.System
500Process ID ProcessId has registered idle task ID IdleTaskId.Diagnostic
501Process ID ProcessId has completed idle task ID IdleTaskId.Diagnostic
502Execution of idle task ID IdleTaskId has started.Diagnostic
503Execution of idle task ID IdleTaskId has ended.Diagnostic
504Idle task ID IdleTaskId has been notified that explicit processing has been …Diagnostic
505Idle task ID IdleTaskId has returned from its explicit processing notification.Diagnostic
506Explicit execution of all idle tasks has been requested.Diagnostic
507Explicit execution of all idle tasks has completed.Diagnostic
508Explicit execution of all idle tasks is in progress.Diagnostic
509Idle Task Power Notification Received: NotificationType (State).Diagnostic
510Diagnostic
511Diagnostic
512Idle check point: State DetectionResult, Reason Reason.Diagnostic
700Task Scheduler service started Task Compatibility module.Operational
701Task Scheduler service failed to start Task Compatibility module.System
702Task Scheduler failed to initialize the RPC server for starting the Task …System
703Task Scheduler failed to initialize Net Schedule API for starting the Task …System
704Task Scheduler failed to initialize LSA for starting the Task Compatibility …System
705Task Scheduler failed to start directory monitoring for the Task Compatibility …System
706Task Compatibility module failed to update task "TaskName" to the required …Operational
707Task Compatibility module failed to delete task "TaskName" .Operational
708Task Compatibility module failed to set security descriptor "SecurityDescriptor" …Operational
709Task Compatibility module failed to update task "TaskName" .Operational
710Task Compatibility module failed to upgrade existing tasks.Operational
711Task Compatibility module failed to upgrade NetSchedule account "Account" .Operational
712Task Compatibility module failed to read existing store to upgrade tasks.Operational
713Task Compatibility module failed to load task "TaskName" for upgrade.Operational
714Task Compatibility module failed to register task "TaskName" for upgrade.Operational
715Task Compatibility module failed to delete LSA store for upgrade.Operational
716Task Compatibility module failed to upgrade existing scheduled tasks.System
717Task Compatibility module failed to determine if upgrade is needed.Operational
718Task scheduler was unable to upgrade the credential store from the Beta 2 …System
719To help optimize for performance, Task Scheduler has automatically disabled …System
800Maintenance state changed to Name (Last Run: hc_stateid).Maintenance
801Maintenance launch operation failed.Maintenance
802Maintenance re-configuration failed.Maintenance
803Maintenance Scheduler engine task "Task" cannot be accessed.Maintenance
804Maintenance Scheduler has detected cyclic dependency for the following …Maintenance
805Maintenance Task "Task" is behind deadline.Maintenance
806Maintenance task "Task" processing error.Maintenance
807Maintenance complete (launch type LauncherId).Maintenance
808Maintenance Task "Name" requests computer wakeup during next regular maintenance …Maintenance
809Maintenance Scheduler Group Policy Settings are not properly specified for …System
998DEBUG!Debug
999DEBUG!Debug

Event ID 100 — Task Scheduler started "UserContext" instance of the "Name" task for user "TaskName".

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Informational
Collection Priority
Recommended (Yamato Security, others)
Task
TaskStarted
Opcode
Start

Description

Task Scheduler started "UserContext" instance of the "Name" task for user "TaskName".

Message #

Task Scheduler started "%3" instance of the "%1" task for user "%2".

Fields #

NameDescription
Name—
TaskName UnicodeString—
UserContext UnicodeString—
InstanceId GUID—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 100,
    "version": 0,
    "level": 4,
    "task": 100,
    "opcode": 1,
    "keywords": 9223372036854775809,
    "time_created": "2023-11-06T02:00:01.374223+00:00",
    "event_record_id": 1052,
    "correlation": {
      "ActivityID": "99F1DF4D-A460-47A9-93D3-3FF029F93E31"
    },
    "execution": {
      "process_id": 1392,
      "thread_id": 18152
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "TaskStartEvent",
    "TaskName": "\\Microsoft\\Windows\\Customer Experience Improvement Program\\Consolidator",
    "UserContext": "NT AUTHORITY\\SYSTEM",
    "InstanceId": "99F1DF4D-A460-47A9-93D3-3FF029F93E31"
  },
  "message": ""
}

References #

Event ID 101 — Task Scheduler failed to start "Name" task for user "TaskName".

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Error
Collection Priority
Recommended (Yamato Security, others)
Task
TaskStartFailed
Opcode
LaunchFailure

Description

Task Scheduler failed to start "Name" task for user "TaskName". Additional Data: Error Value: UserContext.

Message #

Task Scheduler failed to start "%1" task for user "%2". Additional Data: Error Value: %3.

Fields #

NameDescription
Name—
TaskName UnicodeString—
UserContext UnicodeString—
ResultCode UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 101,
    "version": 0,
    "level": 2,
    "task": 101,
    "opcode": 101,
    "keywords": 9223372036854775809,
    "time_created": "2023-11-06T01:06:15.745482+00:00",
    "event_record_id": 929,
    "correlation": {},
    "execution": {
      "process_id": 1392,
      "thread_id": 16668
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "TaskStartFailedEvent",
    "TaskName": "\\Microsoft\\Windows\\UpdateOrchestrator\\USO_UxBroker",
    "UserContext": "NT AUTHORITY\\SYSTEM",
    "ResultCode": 2147942402
  },
  "message": ""
}

References #

Event ID 102 — Task Scheduler successfully finished "UserContext" instance of the "Name" task for user "TaskName".

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Informational
Collection Priority
Recommended (Yamato Security, others)
Task
Taskcompleted
Opcode
Stop

Description

Task Scheduler successfully finished "UserContext" instance of the "Name" task for user "TaskName".

Message #

Task Scheduler successfully finished "%3" instance of the "%1" task for user "%2".

Fields #

NameDescription
Name—
TaskName UnicodeString—
UserContext UnicodeString—
InstanceId GUID—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 102,
    "version": 0,
    "level": 4,
    "task": 102,
    "opcode": 2,
    "keywords": 9223372036854775809,
    "time_created": "2023-11-06T02:00:01.421291+00:00",
    "event_record_id": 1055,
    "correlation": {
      "ActivityID": "99F1DF4D-A460-47A9-93D3-3FF029F93E31"
    },
    "execution": {
      "process_id": 1392,
      "thread_id": 18152
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "TaskSuccessEvent",
    "TaskName": "\\Microsoft\\Windows\\Customer Experience Improvement Program\\Consolidator",
    "UserContext": "NT AUTHORITY\\SYSTEM",
    "InstanceId": "99F1DF4D-A460-47A9-93D3-3FF029F93E31"
  },
  "message": ""
}

References #

Event ID 103 — Task Scheduler failed to start instance "TaskName" of "Name" task for user "InstanceId" .

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Error
Collection Priority
Recommended (Yamato Security, others)
Task
Actionstartfailed
Opcode
RunFailure

Description

Task Scheduler failed to start instance "TaskName" of "Name" task for user "InstanceId" . Additional Data: Error Value: UserContext.

Message #

Task Scheduler failed to start instance "%2" of "%1"  task for user "%3" . Additional Data: Error Value: %4.

Fields #

NameDescription
Name—
TaskName UnicodeString—
InstanceId GUID—
UserContext UnicodeString—
ResultCode UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 103,
    "version": 0,
    "level": 2,
    "task": 103,
    "opcode": 102,
    "keywords": 9223372036854775809,
    "time_created": "2022-04-07T17:15:16.721848+00:00",
    "event_record_id": 605,
    "correlation": {
      "ActivityID": "B0ED2490-E028-43FD-88A4-97F63AB32B71"
    },
    "execution": {
      "process_id": 1528,
      "thread_id": 4560
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "TaskFailureEvent",
    "TaskName": "\\Microsoft\\Windows\\.NET Framework\\.NET Framework NGEN v4.0.30319",
    "InstanceId": "B0ED2490-E028-43FD-88A4-97F63AB32B71",
    "UserContext": "NT AUTHORITY\\SYSTEM",
    "ResultCode": 2147946720
  },
  "message": ""
}

References #

Event ID 104 — Task Scheduler failed to log on "UserName" .

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security, others)
Task
Logonfailure

Description

Task Scheduler failed to log on "UserName" . Failure occurred in "ErrorDescription" . User Action: Ensure the credentials for the task are correctly specified. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler failed to log on "%1" . Failure occurred in "%2" . User Action: Ensure the credentials for the task are correctly specified. Additional Data: Error Value: %3.

Fields #

NameDescription
UserName UnicodeString—
ErrorDescription UnicodeString—
ResultCode UInt32—

Event ID 105 — Task Scheduler failed to impersonate "Context" .

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security, others)
Task
Impersonationfailure

Description

Task Scheduler failed to impersonate "Context" . Additional Data: Error Value: ResultCode.

Message #

Task Scheduler failed to impersonate "%1" . Additional Data: Error Value: %2.

Fields #

NameDescription
Context UnicodeString—
ResultCode UInt32—

Event ID 106 — User "TaskName" registered Task Scheduler task "Name".

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Informational
Collection Priority
Recommended (Microsoft-WEF, others)
Task
Taskregistered

Description

User "TaskName" registered Task Scheduler task "Name".

Message #

User "%2"  registered Task Scheduler task "%1"

Fields #

NameDescription
Name—
TaskName UnicodeString—
UserContext UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 106,
    "version": 0,
    "level": 4,
    "task": 106,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T01:50:56.574711+00:00",
    "event_record_id": 1046,
    "correlation": {},
    "execution": {
      "process_id": 1392,
      "thread_id": 17484
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "TaskRegisteredEvent",
    "TaskName": "\\Mozilla\\Firefox Background Update 308046B0AF4A39CB",
    "UserContext": "WINDEV2310EVAL\\User"
  },
  "message": ""
}

References #

Event ID 107 — Task Scheduler launched "TaskName" instance of task "Name" due to a time trigger condition.

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Informational
Collection Priority
Recommended (Yamato Security, others)
Task
Tasktriggeredonscheduler

Description

Task Scheduler launched "TaskName" instance of task "Name" due to a time trigger condition.

Message #

Task Scheduler launched "%2"  instance of task "%1" due to a time trigger condition.

Fields #

NameDescription
Name—
TaskName UnicodeString—
InstanceId GUID—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 107,
    "version": 0,
    "level": 4,
    "task": 107,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T02:00:01.223731+00:00",
    "event_record_id": 1050,
    "correlation": {
      "ActivityID": "99F1DF4D-A460-47A9-93D3-3FF029F93E31"
    },
    "execution": {
      "process_id": 1392,
      "thread_id": 18152
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "TimeTriggerEvent",
    "TaskName": "\\Microsoft\\Windows\\Customer Experience Improvement Program\\Consolidator",
    "InstanceId": "99F1DF4D-A460-47A9-93D3-3FF029F93E31"
  },
  "message": ""
}

References #

Event ID 108 — Task Scheduler launched "TaskName" instance of task "Name" according to an event trigger.

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Informational
Collection Priority
Recommended (Yamato Security, others)
Task
Tasktriggeredonevent

Description

Task Scheduler launched "TaskName" instance of task "Name" according to an event trigger.

Message #

Task Scheduler launched "%2"  instance of task "%1"  according to an event trigger.

Fields #

NameDescription
Name—
TaskName UnicodeString—
InstanceId GUID—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 108,
    "version": 0,
    "level": 4,
    "task": 108,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T00:51:19.199741+00:00",
    "event_record_id": 873,
    "correlation": {
      "ActivityID": "42D4830B-24FF-4813-B67B-31D1A7EDFA95"
    },
    "execution": {
      "process_id": 1392,
      "thread_id": 15980
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "EventTriggerEvent",
    "TaskName": "\\Avira_Security_Service_SCM_Watchdog",
    "InstanceId": "42D4830B-24FF-4813-B67B-31D1A7EDFA95"
  },
  "message": ""
}

References #

Event ID 109 — Task Scheduler launched "TaskName" instance of task "Name" according to a registration trigger.

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Informational
Collection Priority
Recommended (Yamato Security, others)
Task
Tasktriggeredbyregistration

Description

Task Scheduler launched "TaskName" instance of task "Name" according to a registration trigger.

Message #

Task Scheduler launched "%2"  instance of task "%1"  according to a registration trigger.

Fields #

NameDescription
Name—
TaskName UnicodeString—
InstanceId GUID—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 109,
    "version": 0,
    "level": 4,
    "task": 109,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2022-04-07T16:57:17.740121+00:00",
    "event_record_id": 490,
    "correlation": {
      "ActivityID": "D9A56AB9-DA1B-4E8C-ABB6-0297EE74232D"
    },
    "execution": {
      "process_id": 1528,
      "thread_id": 932
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "RegistrationTriggerEvent",
    "TaskName": "\\CreateExplorerShellUnelevatedTask",
    "InstanceId": "D9A56AB9-DA1B-4E8C-ABB6-0297EE74232D"
  },
  "message": ""
}

References #

Event ID 110 — Task Scheduler launched "TaskName" instance of task "Name" for user "InstanceId" .

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Informational
Collection Priority
Recommended (Yamato Security, others)
Task
Tasktriggeredbyuser

Description

Task Scheduler launched "TaskName" instance of task "Name" for user "InstanceId" .

Message #

Task Scheduler launched "%2"  instance of task "%1"  for user "%3" .

Fields #

NameDescription
Name—
TaskName UnicodeString—
InstanceId GUID—
UserContext UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 110,
    "version": 0,
    "level": 4,
    "task": 110,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T01:45:55.147729+00:00",
    "event_record_id": 1035,
    "correlation": {
      "ActivityID": "3F188DA8-D0E4-4751-AE11-48AA36395E99"
    },
    "execution": {
      "process_id": 1392,
      "thread_id": 14340
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "TaskRunEvent",
    "TaskName": "\\Microsoft\\Windows\\AppID\\VerifiedPublisherCertStoreCheck",
    "InstanceId": "3F188DA8-D0E4-4751-AE11-48AA36395E99",
    "UserContext": "LOCAL SERVICE"
  },
  "message": ""
}

References #

Event ID 111 — Task Scheduler terminated "TaskName" instance of the "Name" task.

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Informational
Collection Priority
Recommended (Yamato Security, others)
Task
Taskterminated
Opcode
Termination

Description

Task Scheduler terminated "TaskName" instance of the "Name" task.

Message #

Task Scheduler terminated "%2"  instance of the "%1"  task.

Fields #

NameDescription
Name—
TaskName UnicodeString—
InstanceId GUID—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 111,
    "version": 0,
    "level": 4,
    "task": 111,
    "opcode": 103,
    "keywords": 9223372036854775809,
    "time_created": "2022-04-07T17:04:28.075331+00:00",
    "event_record_id": 584,
    "correlation": {
      "ActivityID": "F3FE9E7B-2EAA-4ADC-A87D-F751736AF46C"
    },
    "execution": {
      "process_id": 1528,
      "thread_id": 1832
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "TaskTerminationEvent",
    "TaskName": "\\Microsoft\\Windows\\Windows Defender\\Windows Defender Scheduled Scan",
    "InstanceId": "F3FE9E7B-2EAA-4ADC-A87D-F751736AF46C"
  },
  "message": ""
}

References #

Event ID 112 — Task Scheduler could not start task "TaskName" because the network was unavailable.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security, others)
Task
Launchconditionnotmet,networkunavailable

Message #

Task Scheduler could not start task "%1"  because the network was unavailable. User Action: Ensure the computer is connected to the required network as specified in the task. If the task does not require network presence, remove the network condition from the task configuration.

Fields #

NameDescription
TaskName UnicodeString—

Event ID 113 — Task registered task "TaskName" , but not all specified triggers will start the task.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security, others)
Task
Taskregisteredwithoutsometriggers

Description

Task registered task "TaskName" , but not all specified triggers will start the task. User Action: Ensure all the task triggers are valid as configured. Additional Data: Error Value: ResultCode.

Message #

Task registered task "%1" , but not all specified triggers will start the task. User Action: Ensure all the task triggers are valid as configured. Additional Data: Error Value: %2.

Fields #

NameDescription
TaskName UnicodeString—
ResultCode UInt32—

Event ID 114 — Task Scheduler could not launch task "Name" as scheduled.

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Warning
Collection Priority
Recommended (Yamato Security, others)
Task
Missedtaskstarted

Description

Task Scheduler could not launch task "Name" as scheduled. Instance "TaskName" is started now as required by the configuration option to start the task when available, if schedule is missed.

Message #

Task Scheduler could not launch task "%1"  as scheduled. Instance "%2"  is started now as required by the configuration option to start the task when available, if schedule is missed.

Fields #

NameDescription
Name—
TaskName UnicodeString—
InstanceId GUID—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 114,
    "version": 0,
    "level": 3,
    "task": 114,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T01:13:11.834762+00:00",
    "event_record_id": 957,
    "correlation": {
      "ActivityID": "BDD12A1E-2CB7-4353-8C11-BD828F20ABC1"
    },
    "execution": {
      "process_id": 1392,
      "thread_id": 14508
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "MissedTaskLaunched",
    "TaskName": "\\Microsoft\\Windows\\Speech\\SpeechModelDownloadTask",
    "InstanceId": "BDD12A1E-2CB7-4353-8C11-BD828F20ABC1"
  },
  "message": ""
}

References #

Event ID 115 — Task Scheduler failed to roll back a transaction when updating or deleting a task.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security, others)
Task
Taskupdateordeletionerror

Description

Task Scheduler failed to roll back a transaction when updating or deleting a task. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler failed to roll back a transaction when updating or deleting a task. Additional Data: Error Value: %1.

Fields #

NameDescription
ResultCode UInt32—

Event ID 116 — Task Scheduler validated the configuration for task "TaskName" , but credentials could not be stored.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security, others)
Task
Taskregisteredwithoutcredentials

Description

Task Scheduler validated the configuration for task "TaskName" , but credentials could not be stored. User Action: Re-register the task ensuring the credentials are valid. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler validated the configuration for task "%1" , but credentials could not be stored. User Action: Re-register the task ensuring the credentials are valid. Additional Data: Error Value: %2.

Fields #

NameDescription
TaskName UnicodeString—
ResultCode UInt32—

Event ID 117 — Task Scheduler launched "InstanceId" instance of task "TaskName" due to an idle condition.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security, others)
Task
TasktriggeredonIdle

Description

Task Scheduler launched "InstanceId" instance of task "TaskName" due to an idle condition.

Message #

Task Scheduler launched "%2"  instance of task "%1"  due to an idle condition.

Fields #

NameDescription
TaskName UnicodeString—
InstanceId GUID—

Event ID 118 — Task Scheduler launched "TaskName" instance of task "Name" due to system startup.

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Informational
Collection Priority
Recommended (Yamato Security, others)
Task
Tasktriggeredbycomputerstartup

Description

Task Scheduler launched "TaskName" instance of task "Name" due to system startup.

Message #

Task Scheduler launched "%2"  instance of task "%1"  due to system startup.

Fields #

NameDescription
Name—
TaskName UnicodeString—
InstanceId GUID—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 118,
    "version": 0,
    "level": 4,
    "task": 118,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2022-04-07T17:33:13.191335+00:00",
    "event_record_id": 608,
    "correlation": {
      "ActivityID": "CEC1B472-A8F7-4346-930D-03F9473C9804"
    },
    "execution": {
      "process_id": 1528,
      "thread_id": 1108
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "BootTrigger",
    "TaskName": "\\Microsoft\\Windows\\Autochk\\Proxy",
    "InstanceId": "CEC1B472-A8F7-4346-930D-03F9473C9804"
  },
  "message": ""
}

References #

Event ID 119 — Task Scheduler launched "UserName" instance of task "Name" due to user "TaskName" logon.

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Informational
Collection Priority
Recommended (Yamato Security, others)
Task
Tasktriggeredonlogon

Description

Task Scheduler launched "UserName" instance of task "Name" due to user "TaskName" logon.

Message #

Task Scheduler launched "%3"  instance of task "%1" due to user "%2"  logon.

Fields #

NameDescription
Name—
TaskName UnicodeString—
UserName UnicodeString—
InstanceId GUID—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 119,
    "version": 0,
    "level": 4,
    "task": 119,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T01:13:11.548668+00:00",
    "event_record_id": 948,
    "correlation": {
      "ActivityID": "7883A91A-AE57-4AD3-B9A9-F6B93677D5B6"
    },
    "execution": {
      "process_id": 1392,
      "thread_id": 14508
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "LogonTrigger",
    "TaskName": "\\Microsoft\\Windows\\Management\\Provisioning\\Logon",
    "UserName": "WINDEV2310EVAL\\User",
    "InstanceId": "7883A91A-AE57-4AD3-B9A9-F6B93677D5B6"
  },
  "message": ""
}

References #

Event ID 120 — Task Scheduler launched "InstanceId" instance of task "TaskName" due to user "UserName" connecting to the console trigger.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security, others)
Task
Tasktriggeredonlocalconsoleconnect

Description

Task Scheduler launched "InstanceId" instance of task "TaskName" due to user "UserName" connecting to the console trigger.

Message #

Task Scheduler launched "%3"  instance of task "%1"  due to user "%2"  connecting to the console trigger.

Fields #

NameDescription
TaskName UnicodeString—
UserName UnicodeString—
InstanceId GUID—

Event ID 121 — Task Scheduler launched "InstanceId" instance of task "TaskName" due to user "UserName" disconnecting from the console trigger.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security, others)
Task
Tasktriggeredonlocalconsoledisconnect

Description

Task Scheduler launched "InstanceId" instance of task "TaskName" due to user "UserName" disconnecting from the console trigger.

Message #

Task Scheduler launched "%3"  instance of task "%1"  due to user "%2"  disconnecting from the console trigger.

Fields #

NameDescription
TaskName UnicodeString—
UserName UnicodeString—
InstanceId GUID—

Event ID 122 — Task Scheduler launched "InstanceId" instance of task "TaskName" due to user "UserName" remotely connecting trigger.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security, others)
Task
Tasktriggeredonremoteconsoleconnect

Description

Task Scheduler launched "InstanceId" instance of task "TaskName" due to user "UserName" remotely connecting trigger.

Message #

Task Scheduler launched "%3"  instance of task "%1"  due to user "%2"  remotely connecting trigger.

Fields #

NameDescription
TaskName UnicodeString—
UserName UnicodeString—
InstanceId GUID—

Event ID 123 — Task Scheduler launched "InstanceId" instance of task "TaskName" due to user "UserName" remotely disconnecting trigger.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security, others)
Task
Tasktriggeredonremoteconsoledisconnect

Description

Task Scheduler launched "InstanceId" instance of task "TaskName" due to user "UserName" remotely disconnecting trigger.

Message #

Task Scheduler launched "%3"  instance of task "%1"  due to user "%2"  remotely disconnecting trigger.

Fields #

NameDescription
TaskName UnicodeString—
UserName UnicodeString—
InstanceId GUID—

Event ID 124 — Task Scheduler launched "InstanceId" instance of task "TaskName" due to user "UserName" locking the computer trigger.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security, others)
Task
Tasktriggeredbylockingtheworkstation

Description

Task Scheduler launched "InstanceId" instance of task "TaskName" due to user "UserName" locking the computer trigger.

Message #

Task Scheduler launched "%3"  instance of task "%1"  due to user "%2"  locking the computer trigger.

Fields #

NameDescription
TaskName UnicodeString—
UserName UnicodeString—
InstanceId GUID—

Event ID 125 — Task Scheduler launched "InstanceId" instance of task "TaskName" due to user "UserName" unlocking the computer trigger.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security, others)
Task
Tasktriggeredbyunlockingtheworkstation

Description

Task Scheduler launched "InstanceId" instance of task "TaskName" due to user "UserName" unlocking the computer trigger.

Message #

Task Scheduler launched "%3"  instance of task "%1"  due to user "%2"  unlocking the computer trigger.

Fields #

NameDescription
TaskName UnicodeString—
UserName UnicodeString—
InstanceId GUID—

Event ID 126 — Task Scheduler failed to execute task "TaskName" .

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security, others)
Task
Taskrestartedonfailure

Description

Task Scheduler failed to execute task "TaskName" . Attempting to restart. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler failed to execute task "%1" . Attempting to restart. Additional Data: Error Value: %2.

Fields #

NameDescription
TaskName UnicodeString—
ResultCode UInt32—

Event ID 127 — Task Scheduler failed to execute task "TaskName" due to a shutdown race condition.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security, others)
Task
Taskrestartedonfailure_127

Description

Task Scheduler failed to execute task "TaskName" due to a shutdown race condition. Attempting to restart.

Message #

Task Scheduler failed to execute task "%1"  due to a shutdown race condition. Attempting to restart.

Fields #

NameDescription
TaskName UnicodeString—

Event ID 128 — Task Scheduler did not launch task "TaskName" , because current time exceeds the configured task end time.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security, others)
Task
Launchconditionnotmet,beyondendtime

Description

Task Scheduler did not launch task "TaskName" , because current time exceeds the configured task end time. User Action: Extend the end time boundary for the task if required.

Message #

Task Scheduler did not launch task "%1" , because current time exceeds the configured task end time. User Action: Extend the end time boundary for the task if required.

Fields #

NameDescription
TaskName UnicodeString—

Event ID 129 — Task Scheduler launch task "Name" , instance "TaskName" with process ID Path.

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Informational
Collection Priority
Recommended (Yamato Security, others)
Task
CreatedTaskProcess

Description

Task Scheduler launch task "Name" , instance "TaskName" with process ID Path.

Message #

Task Scheduler launch task "%1" , instance "%2"  with process ID %3.

Fields #

NameDescription
Name—
TaskName UnicodeString—
Path UnicodeString—
ProcessID UInt32—
Priority UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 129,
    "version": 0,
    "level": 4,
    "task": 129,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T02:00:01.371079+00:00",
    "event_record_id": 1051,
    "correlation": {},
    "execution": {
      "process_id": 1392,
      "thread_id": 18152
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "CreatedTaskProcess",
    "TaskName": "\\Microsoft\\Windows\\Customer Experience Improvement Program\\Consolidator",
    "Path": "%SystemRoot%\\System32\\wsqmcons.exe",
    "ProcessID": 16312,
    "Priority": 16384
  },
  "message": ""
}

Detection Rules #

View all rules referencing this event →

Sigma # view in reference

References #

Event ID 130 — Task Scheduler failed to start task "TaskName" due to the service being busy.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security, others)
Task
Launchconditionnotmet,servicebusy

Description

Task Scheduler failed to start task "TaskName" due to the service being busy.

Message #

Task Scheduler failed to start task "%1" due to the service being busy.

Fields #

NameDescription
TaskName UnicodeString—
ResultCode UInt32—

Event ID 131 — Task Scheduler failed to start task "TaskName" because the number of tasks in the task queue exceeding the quota currently configured to CurrentQuota.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security, others)
Task
Launchconditionnotmet,quotaexceeded

Message #

Task Scheduler failed to start task "%1" because the number of tasks in the task queue exceeding the quota currently configured to %2. User Action: Reduce the number of running tasks or increase the configured queue quota.

Fields #

NameDescription
TaskName UnicodeString—
CurrentQuota UInt32—

Event ID 132 — Task Scheduler task launching queue quota is approaching its preset limit of tasks currently configured to CurrentQuota.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security, others)
Task
Launchconditionwarning,quotaapproaching

Description

Task Scheduler task launching queue quota is approaching its preset limit of tasks currently configured to CurrentQuota. User Action: Reduce the number of running tasks or increase the configured queue quota.

Message #

Task Scheduler task launching queue quota is approaching its preset limit of tasks currently configured to %1. User Action: Reduce the number of running tasks or increase the configured queue quota.

Fields #

NameDescription
CurrentQuota UInt32—

Event ID 133 — Task Scheduler failed to start task TaskName" in TaskEngine "TaskEngineName" for user "UserName".

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security, others)
Task
Launchconditionnotmet,quotaexceeded_133

Description

Task Scheduler failed to start task TaskName" in TaskEngine "TaskEngineName" for user "UserName". User Action: Reduce the number of tasks running in the specified user context.

Message #

Task Scheduler failed to start task %1" in TaskEngine "%2"  for user "%3". User Action: Reduce the number of tasks running in the specified user context.

Fields #

NameDescription
TaskName UnicodeString—
TaskEngineName UnicodeString—
UserName UnicodeString—

Event ID 134 — Task Engine "TaskEngineName" for user "UserName" is approaching its preset limit of tasks.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security, others)
Task
Launchconditionwarning,quotaapproaching_134

Description

Task Engine "TaskEngineName" for user "UserName" is approaching its preset limit of tasks. User Action: Reduce the number of tasks running in the specified user context.

Message #

Task Engine "%1"  for user "%2" is approaching its preset limit of tasks. User Action: Reduce the number of tasks running in the specified user context.

Fields #

NameDescription
TaskEngineName UnicodeString—
UserName UnicodeString—

Event ID 135 — Task Scheduler could not start task "TaskName" because the machine was not idle.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security, others)
Task
Launchconditionnotmet,machinenotidle

Description

Task Scheduler could not start task "TaskName" because the machine was not idle.

Message #

Task Scheduler could not start task "%1"  because the machine was not idle.

Fields #

NameDescription
TaskName UnicodeString—

Event ID 140 — User "TaskName" updated Task Scheduler task "Name".

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Informational
Collection Priority
Recommended (Yamato Security, others)
Task
Taskregistrationupdated

Description

User "TaskName" updated Task Scheduler task "Name".

Message #

User "%2"  updated Task Scheduler task "%1"

Fields #

NameDescription
Name—
TaskName UnicodeString—
UserName UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 140,
    "version": 0,
    "level": 4,
    "task": 140,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T02:00:32.944571+00:00",
    "event_record_id": 1057,
    "correlation": {},
    "execution": {
      "process_id": 1392,
      "thread_id": 16536
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "TaskUpdated",
    "TaskName": "\\Microsoft\\Windows\\UpdateOrchestrator\\Schedule Work",
    "UserName": "WORKGROUP\\WINDEV2310EVAL$"
  },
  "message": ""
}

References #

Event ID 141 — User "TaskName" deleted Task Scheduler task "Name".

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Informational
Collection Priority
Recommended (Microsoft-WEF, others)
Task
Taskregistrationdeleted

Description

User "TaskName" deleted Task Scheduler task "Name".

Message #

User "%2"  deleted Task Scheduler task "%1"

Fields #

NameDescription
Name—
TaskName UnicodeString—
UserName UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 141,
    "version": 0,
    "level": 4,
    "task": 141,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T01:01:44.133714+00:00",
    "event_record_id": 911,
    "correlation": {},
    "execution": {
      "process_id": 1392,
      "thread_id": 13064
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "TaskDeleted",
    "TaskName": "\\TVInstallRestore",
    "UserName": "WINDEV2310EVAL\\User"
  },
  "message": ""
}

Detection Rules #

View all rules referencing this event →

Sigma # view in reference

  • Important Scheduled Task Deleted source high: Detects when adversaries try to stop system services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities

References #

Event ID 142 — User "TaskName" disabled Task Scheduler task "Name".

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Informational
Collection Priority
Recommended (Microsoft-WEF, others)
Task
Taskdisabled

Description

User "TaskName" disabled Task Scheduler task "Name".

Message #

User "%2"  disabled Task Scheduler task "%1"

Fields #

NameDescription
Name—
TaskName UnicodeString—
UserName UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 142,
    "version": 0,
    "level": 4,
    "task": 142,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-09T00:56:06.060816+00:00",
    "event_record_id": 31710,
    "correlation": {
      "ActivityID": "973CC99D-202A-4A9A-A6DF-75F5CFD7D7B7"
    },
    "execution": {
      "process_id": 1972,
      "thread_id": 3956
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "TaskDisabled",
    "TaskName": "\\Microsoft\\Windows\\Workplace Join\\Automatic-Device-Join",
    "UserName": "System"
  },
  "message": ""
}

Event ID 145 — Task Scheduler woke up the computer to run a task.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Tasktriggeredbycomingoutofsuspendmode

Description

Task Scheduler woke up the computer to run a task.

Message #

Task Scheduler woke up the computer to run a task.

Event ID 146 — Task Scheduler failed to load task "TaskName" at service startup.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Taskloadingatservicestartupfailed

Description

Task Scheduler failed to load task "TaskName" at service startup. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler failed to load task "%1" at service startup. Additional Data: Error Value: %2.

Fields #

NameDescription
TaskName UnicodeString—
ResultCode UInt32—

Event ID 147 — Task Scheduler recovered sucessfully the image of task "TaskName" after a corruption occured during OS upgrade.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
TaskimagerecoveredafterOSmigration

Description

Task Scheduler recovered sucessfully the image of task "TaskName" after a corruption occured during OS upgrade.

Message #

Task Scheduler recovered sucessfully the image of task "%1" after a corruption occured during OS upgrade.

Fields #

NameDescription
TaskName UnicodeString—

Event ID 148 — Task Scheduler failed to recover the image of task "TaskName" after a corruption occured during OS upgrade.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
TaskimagerecoveringfailedafterOSmigration

Description

Task Scheduler failed to recover the image of task "TaskName" after a corruption occured during OS upgrade. Additional Data: Error Value: 0xResultCode.

Message #

Task Scheduler failed to recover the image of task "%1" after a corruption occured during OS upgrade. Additional Data: Error Value: 0x%2.

Fields #

NameDescription
TaskName UnicodeString—
ResultCode HexInt32—

Event ID 149 — Task "TaskName" is using a combination of properties that is incompatible with the scheduling engine.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Taskisusingacombinationofpropertiesthatisincompatiblewiththeschedulingengine

Description

Task "TaskName" is using a combination of properties that is incompatible with the scheduling engine.

Message #

Task "%1" is using a combination of properties that is incompatible with the scheduling engine.

Fields #

NameDescription
TaskName UnicodeString—

Event ID 150 — Task Scheduler failed to subscribe for the event trigger for task "TaskName".

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Taskregistrationoneventfailed

Description

Task Scheduler failed to subscribe for the event trigger for task "TaskName". Additional Data: Error Value: ResultCode.

Message #

Task Scheduler failed to subscribe for the event trigger for task "%1". Additional Data: Error Value: %2.

Fields #

NameDescription
TaskName UnicodeString—
ResultCode UInt32—

Event ID 151 — Task instantiation failed "TaskName".

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
TaskSchedulerfailedtoinstantiatetaskatservicestartup.

Description

Task instantiation failed "TaskName". Check point: LogPoint. Error Value: ResultCode.

Message #

Task instantiation failed "%1". Check point: %2. Error Value: %3.

Fields #

NameDescription
TaskName UnicodeString—
LogPoint UnicodeString—
ResultCode UInt32—

Event ID 152 — Task "TaskName" was re-directed to legacy scheduling engine.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Taskwasredirectedtolegacyengine

Description

Task "TaskName" was re-directed to legacy scheduling engine.

Message #

Task "%1" was re-directed to legacy scheduling engine.

Fields #

NameDescription
TaskName UnicodeString—

Event ID 153 — Task Scheduler did not launch task "Name" as it missed its schedule.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Warning
Collection Priority
Recommended (Yamato Security)
Task
Missedtaskstartrejected

Description

Task Scheduler did not launch task "Name" as it missed its schedule. Consider using the configuration option to start the task when available, if schedule is missed.

Message #

Task Scheduler did not launch task "%1" as it missed its schedule. Consider using the configuration option to start the task when available, if schedule is missed.

Fields #

NameDescription
Name—
TaskName UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 153,
    "version": 0,
    "level": 3,
    "task": 153,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-08T23:13:40.561331+00:00",
    "event_record_id": 30099,
    "correlation": {},
    "execution": {
      "process_id": 2316,
      "thread_id": 9952
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "MissedTaskRejected",
    "TaskName": "\\Microsoft\\Windows\\Security\\Pwdless\\IntelligentPwdlessTask"
  },
  "message": ""
}

Event ID 155 — Task Scheduler is currently waiting on completion of task "TaskPath".

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
TaskCompletionPending

Description

Task Scheduler is currently waiting on completion of task "TaskPath".

Message #

Task Scheduler is currently waiting on completion of task "%1".

Fields #

NameDescription
TaskPath UnicodeString—

Event ID 200 — Task Scheduler launched action "TaskName" in instance "ActionName" of task "Name".

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Informational
Collection Priority
Recommended (NSA, others)
Task
Actionstarted
Opcode
Start

Description

Task Scheduler launched action "TaskName" in instance "ActionName" of task "Name".

Message #

Task Scheduler launched action "%2" in instance "%3" of task "%1".

Fields #

NameDescription
Name—
TaskName UnicodeString—
ActionName UnicodeString—
TaskInstanceId GUID—
EnginePID UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 200,
    "version": 1,
    "level": 4,
    "task": 200,
    "opcode": 1,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T02:00:01.374228+00:00",
    "event_record_id": 1053,
    "correlation": {
      "ActivityID": "99F1DF4D-A460-47A9-93D3-3FF029F93E31"
    },
    "execution": {
      "process_id": 1392,
      "thread_id": 18152
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "ActionStart",
    "TaskName": "\\Microsoft\\Windows\\Customer Experience Improvement Program\\Consolidator",
    "ActionName": "%SystemRoot%\\System32\\wsqmcons.exe",
    "TaskInstanceId": "99F1DF4D-A460-47A9-93D3-3FF029F93E31",
    "EnginePID": 16312
  },
  "message": ""
}

Detection Patterns #

References #

Event ID 201 — Task Scheduler successfully completed task "Name" , instance "TaskInstanceId" , action "TaskName" .

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Informational
Collection Priority
Recommended (Yamato Security, others)
Task
Actioncompleted
Opcode
Stop

Description

Task Scheduler successfully completed task "Name" , instance "TaskInstanceId" , action "TaskName" .

Message #

Task Scheduler successfully completed task "%1" , instance "%3" , action "%2" .

Fields #

NameDescription
Name—
TaskName UnicodeString—
TaskInstanceId GUID—
ActionName UnicodeString—
ResultCode UInt32—
EnginePID UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 201,
    "version": 2,
    "level": 4,
    "task": 201,
    "opcode": 2,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T02:00:01.421064+00:00",
    "event_record_id": 1054,
    "correlation": {
      "ActivityID": "99F1DF4D-A460-47A9-93D3-3FF029F93E31"
    },
    "execution": {
      "process_id": 1392,
      "thread_id": 18152
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "ActionSuccess",
    "TaskName": "\\Microsoft\\Windows\\Customer Experience Improvement Program\\Consolidator",
    "TaskInstanceId": "99F1DF4D-A460-47A9-93D3-3FF029F93E31",
    "ActionName": "%SystemRoot%\\System32\\wsqmcons.exe",
    "ResultCode": 0,
    "EnginePID": 16312
  },
  "message": ""
}

Detection Patterns #

References #

Event ID 202 — Task Scheduler failed to complete task "Name" , instance "TaskName" , action "TaskInstanceId" .

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Error
Collection Priority
Recommended (Yamato Security)
Task
Actionfailed
Opcode
RunFailure

Description

Task Scheduler failed to complete task "Name" , instance "TaskName" , action "TaskInstanceId" . Additional Data: Error Value: ActionName.

Message #

Task Scheduler failed to complete task "%1" , instance "%2" , action "%3" . Additional Data: Error Value: %4.

Fields #

NameDescription
Name—
TaskName UnicodeString—
TaskInstanceId GUID—
ActionName UnicodeString—
ResultCode UInt32—
EnginePID UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 202,
    "version": 1,
    "level": 2,
    "task": 202,
    "opcode": 102,
    "keywords": 9223372036854775808,
    "time_created": "2022-04-07T17:15:16.721847+00:00",
    "event_record_id": 604,
    "correlation": {
      "ActivityID": "B0ED2490-E028-43FD-88A4-97F63AB32B71"
    },
    "execution": {
      "process_id": 1528,
      "thread_id": 4560
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "ActionFailure",
    "TaskName": "\\Microsoft\\Windows\\.NET Framework\\.NET Framework NGEN v4.0.30319",
    "TaskInstanceId": "B0ED2490-E028-43FD-88A4-97F63AB32B71",
    "ActionName": "",
    "ResultCode": 2147946720,
    "EnginePID": 3796
  },
  "message": ""
}

References #

Event ID 203 — Task Scheduler failed to launch action "TaskInstanceId" in instance "TaskName" of task "Name".

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Error
Collection Priority
Recommended (Yamato Security)
Task
Actionfailedtostart
Opcode
LaunchFailure

Description

Task Scheduler failed to launch action "TaskInstanceId" in instance "TaskName" of task "Name". Additional Data: Error Value: ActionName.

Message #

Task Scheduler failed to launch action "%3" in instance "%2" of task "%1". Additional Data: Error Value: %4.

Fields #

NameDescription
Name—
TaskName UnicodeString—
TaskInstanceId GUID—
ActionName UnicodeString—
ResultCode UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 203,
    "version": 0,
    "level": 2,
    "task": 203,
    "opcode": 101,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T01:06:15.745198+00:00",
    "event_record_id": 928,
    "correlation": {
      "ActivityID": "0EBFF706-5D1E-403C-8FEB-AA1502A28BF9"
    },
    "execution": {
      "process_id": 1392,
      "thread_id": 16668
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "ActionLaunchFailure",
    "TaskName": "\\Microsoft\\Windows\\UpdateOrchestrator\\USO_UxBroker",
    "TaskInstanceId": "0EBFF706-5D1E-403C-8FEB-AA1502A28BF9",
    "ActionName": "%systemroot%\\system32\\MusNotification.exe",
    "ResultCode": 2147942402
  },
  "message": ""
}

References #

Event ID 204 — Task Scheduler failed to retrieve the event triggering values for task "TaskName" .

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Taskfailedtostartonevent

Description

Task Scheduler failed to retrieve the event triggering values for task "TaskName" . The event will be ignored. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler failed to retrieve the event triggering values for task "%1" . The event will be ignored. Additional Data: Error Value: %2.

Fields #

NameDescription
TaskName UnicodeString—
ResultCode UInt32—

Event ID 205 — Task Scheduler failed to match the pattern of events for task "TaskName" .

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Taskfailedtostartoneventpatternmatch

Description

Task Scheduler failed to match the pattern of events for task "TaskName" . The events will be ignored. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler failed to match the pattern of events for task "%1" . The events will be ignored. Additional Data: Error Value: %2.

Fields #

NameDescription
TaskName UnicodeString—
ResultCode UInt32—

Event ID 300 — Task Scheduler started Task Engine "TaskEngineName" with process ID ProcessID.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Taskenginelaunched
Opcode
Start

Description

Task Scheduler started Task Engine "TaskEngineName" with process ID ProcessID.

Message #

Task Scheduler started Task Engine "%1"  with process ID %2.

Fields #

NameDescription
TaskEngineName UnicodeString—
ProcessID UInt32—

Event ID 301 — Task Scheduler is shutting down Task Engine "TaskEngineName".

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Taskengineproperlyshutdown
Opcode
Stop

Description

Task Scheduler is shutting down Task Engine "TaskEngineName".

Message #

Task Scheduler is shutting down Task Engine "%1"

Fields #

NameDescription
TaskEngineName UnicodeString—

Event ID 303 — Task Scheduler is shutting down Task Engine "TaskEngineName" due to an error in "ErrorDescription" .

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Taskengineshutdownduetoerror
Opcode
Failure

Description

Task Scheduler is shutting down Task Engine "TaskEngineName" due to an error in "ErrorDescription" . Additional Data: Error Value: ResultCode.

Message #

Task Scheduler is shutting down Task Engine "%1"  due to an error in "%2" .  Additional Data: Error Value: %3.

Fields #

NameDescription
TaskEngineName UnicodeString—
ErrorDescription UnicodeString—
ResultCode UInt32—

Event ID 304 — Task Scheduler sent "TaskName" task to Task Engine "TaskEngineName" .

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Tasksenttoengine

Description

Task Scheduler sent "TaskName" task to Task Engine "TaskEngineName" . The task instance Id is "TaskInstanceId" .

Message #

Task Scheduler sent "%1"  task to Task Engine "%2" . The task instance Id is "%3" .

Fields #

NameDescription
TaskName UnicodeString—
TaskEngineName UnicodeString—
TaskInstanceId GUID—

Event ID 305 — Task Scheduler did not send "TaskName" task to Task Engine "TaskEngineName" .

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Taskfailedtobesenttoengine
Opcode
Failure

Description

Task Scheduler did not send "TaskName" task to Task Engine "TaskEngineName" . Additional Data: Error Value: ResultCode.

Message #

Task Scheduler did not send "%1"  task to Task Engine "%2" . Additional Data: Error Value: %3.

Fields #

NameDescription
TaskName UnicodeString—
TaskEngineName UnicodeString—
ResultCode UInt32—

Event ID 306 — For Task Scheduler Task Engine "TaskEngineName" , the thread pool failed to process the message.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Enginefailedtoreceivethetask
Opcode
Failure

Description

For Task Scheduler Task Engine "TaskEngineName" , the thread pool failed to process the message. Additional Data: Error Value: ResultCode.

Message #

For Task Scheduler Task Engine "%1" , the thread pool failed to process the message. Additional Data: Error Value: %2.

Fields #

NameDescription
TaskEngineName UnicodeString—
ResultCode UInt32—

Event ID 307 — Task Scheduler service failed to connect to the Task Engine "TaskEngineName" process.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
ServiceEngineconnectionfailure
Opcode
Failure

Description

Task Scheduler service failed to connect to the Task Engine "TaskEngineName" process. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler service failed to connect to the Task Engine "%1"  process. Additional Data: Error Value: %2.

Fields #

NameDescription
TaskEngineName UnicodeString—
ResultCode UInt32—

Event ID 308 — Task Scheduler connected to the Task Engine "TaskEngineName" process.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
ServiceEngineconnected

Description

Task Scheduler connected to the Task Engine "TaskEngineName" process.

Message #

Task Scheduler connected to the Task Engine "%1"  process.

Fields #

NameDescription
TaskEngineName UnicodeString—

Event ID 309 — Task Scheduler TaskCount tasks orphaned during Task Engine "TaskEngineName" shutdown.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Engineorphaned

Description

Task Scheduler TaskCount tasks orphaned during Task Engine "TaskEngineName" shutdown. User Action: Find the process run by this task in the Task Manager and kill it manually.

Message #

Task Scheduler %1 tasks orphaned during Task Engine "%2"  shutdown. User Action: Find the process run by this task in the Task Manager and kill it manually.

Fields #

NameDescription
TaskCount UInt32—
TaskEngineName UnicodeString—

Event ID 310 — Task Scheduler started Task Engine "TaskEngineName" process.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
TaskEnginestarted

Description

Task Scheduler started Task Engine "TaskEngineName" process. Command="Command" , ProcessID=ProcessID, ThreadID=ThreadID.

Message #

Task Scheduler started Task Engine "%1"  process. Command="%2" , ProcessID=%3, ThreadID=%4

Fields #

NameDescription
TaskEngineName UnicodeString—
Command UnicodeString—
ProcessID UInt32—
ThreadID UInt32—

Event ID 311 — Task Scheduler failed to start Task Engine "TaskEngineName" process due to an error occurring in "ErrorDescription" .

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
TaskEnginefailedtostart
Opcode
LaunchFailure

Description

Task Scheduler failed to start Task Engine "TaskEngineName" process due to an error occurring in "ErrorDescription" . Command="Command" . Additional Data: Error Value: ResultCode.

Message #

Task Scheduler failed to start Task Engine "%1"  process due to an error occurring in "%3" . Command="%2" . Additional Data: Error Value: %4.

Fields #

NameDescription
TaskEngineName UnicodeString—
Command UnicodeString—
ErrorDescription UnicodeString—
ResultCode UInt32—

Event ID 312 — Task Scheduler created the Win32 job object for Task Engine "TaskEngineName" .

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
TaskEnginejobobjectcreated

Description

Task Scheduler created the Win32 job object for Task Engine "TaskEngineName" .

Message #

Task Scheduler created the Win32 job object for Task Engine "%1" .

Fields #

NameDescription
TaskEngineName UnicodeString—

Event ID 313 — Task Scheduler channel with Task Engine "TaskEngineName" is ready to send and receive messages.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
ServiceEnginechannelready

Description

Task Scheduler channel with Task Engine "TaskEngineName" is ready to send and receive messages.

Message #

Task Scheduler channel with Task Engine "%1"  is ready to send and receive messages.

Fields #

NameDescription
TaskEngineName UnicodeString—

Event ID 314 — Task Scheduler has no tasks running for Task Engine "TaskEngineName" , and the idle timer has started.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
TaskEngineidle

Description

Task Scheduler has no tasks running for Task Engine "TaskEngineName" , and the idle timer has started.

Message #

Task Scheduler has no tasks running for Task Engine "%1" , and the idle timer has started.

Fields #

NameDescription
TaskEngineName UnicodeString—

Event ID 315 — Task Engine "TaskEngineName" process failed to connect to the Task Scheduler service.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
ServiceEngineconnectionfailure_315
Opcode
Failure

Description

Task Engine "TaskEngineName" process failed to connect to the Task Scheduler service. Additional Data: Error Value: ResultCode.

Message #

Task Engine "%1"  process failed to connect to the Task Scheduler service. Additional Data: Error Value: %2.

Fields #

NameDescription
TaskEngineName UnicodeString—
ResultCode UInt32—

Event ID 316 — Task Engine "TaskEngineName" failed to send a message to the Task Scheduler service.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Enginefailedtosendmessagetoservice
Opcode
Failure

Description

Task Engine "TaskEngineName" failed to send a message to the Task Scheduler service. Additional Data: Error Value: ResultCode.

Message #

Task Engine "%1"  failed to send a message to the Task Scheduler service. Additional Data: Error Value: %2.

Fields #

NameDescription
TaskEngineName UnicodeString—
ResultCode UInt32—

Event ID 317 — Task Scheduler started Task Engine "TaskEngineName" process.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
TaskEnginestarted_317
Opcode
Start

Description

Task Scheduler started Task Engine "TaskEngineName" process.

Message #

Task Scheduler started Task Engine "%1"  process.

Fields #

NameDescription
TaskEngineName UnicodeString—

Event ID 318 — Task Scheduler shutdown Task Engine "TaskEngineName" process.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Taskengineproperlyshutdown_318
Opcode
Stop

Description

Task Scheduler shutdown Task Engine "TaskEngineName" process.

Message #

Task Scheduler shutdown Task Engine "%1"  process.

Fields #

NameDescription
TaskEngineName UnicodeString—

Event ID 319 — Task Engine "TaskEngineName" received a message from Task Scheduler service requesting to launch task "TaskName" .

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
TaskEnginereceivedmessagetostarttask
Opcode
Start

Description

Task Engine "TaskEngineName" received a message from Task Scheduler service requesting to launch task "TaskName" .

Message #

Task Engine "%1"  received a message from Task Scheduler service requesting to launch task "%2" .

Fields #

NameDescription
TaskEngineName UnicodeString—
TaskName UnicodeString—

Event ID 320 — Task Engine "TaskEngineName" received a message from Task Scheduler service requesting to stop task instance "TaskInstanceId" .

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
TaskEnginereceivedmessagetostoptask
Opcode
Stop

Description

Task Engine "TaskEngineName" received a message from Task Scheduler service requesting to stop task instance "TaskInstanceId" .

Message #

Task Engine "%1"  received a message from Task Scheduler service requesting to stop task instance "%2" .

Fields #

NameDescription
TaskEngineName UnicodeString—
TaskInstanceId GUID—

Event ID 322 — Task Scheduler did not launch task "Name" because instance "TaskName" of the same task is already running.

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Warning
Collection Priority
Recommended (Yamato Security)
Task
Launchrequestignored,instancealreadyrunning

Description

Task Scheduler did not launch task "Name" because instance "TaskName" of the same task is already running.

Message #

Task Scheduler did not launch task "%1"  because instance "%2"  of the same task is already running.

Fields #

NameDescription
Name—
TaskName UnicodeString—
TaskInstanceId GUID—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 322,
    "version": 0,
    "level": 3,
    "task": 322,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T00:37:25.158852+00:00",
    "event_record_id": 819,
    "correlation": {
      "ActivityID": "3428C28C-0C94-487C-AC7E-0E29218A38C7"
    },
    "execution": {
      "process_id": 1392,
      "thread_id": 13712
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "NewInstanceIgnored",
    "TaskName": "\\Microsoft\\Windows\\UpdateOrchestrator\\Schedule Scan Static Task",
    "TaskInstanceId": "3428C28C-0C94-487C-AC7E-0E29218A38C7"
  },
  "message": ""
}

References #

Event ID 323 — Task Scheduler stopped instance "StoppedTaskInstanceId" of task "TaskName" in order to launch new instance "NewTaskInstanceId" .

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Launchrequestacknowledged,currentinstancestopped

Description

Task Scheduler stopped instance "StoppedTaskInstanceId" of task "TaskName" in order to launch new instance "NewTaskInstanceId" .

Message #

Task Scheduler stopped instance "%2"  of task "%1"  in order to launch new instance "%3" .

Fields #

NameDescription
TaskName UnicodeString—
StoppedTaskInstanceId GUID—
NewTaskInstanceId GUID—

Event ID 324 — Task Scheduler queued instance "TaskName" of task "Name" and will launch it as soon as instance "QueuedTaskInstanceId" completes.

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Warning
Collection Priority
Recommended (Yamato Security)
Task
Launchrequestqueued,instancealreadyrunning

Description

Task Scheduler queued instance "TaskName" of task "Name" and will launch it as soon as instance "QueuedTaskInstanceId" completes.

Message #

Task Scheduler queued instance "%2"  of task "%1"  and will launch it as soon as instance "%3"  completes.

Fields #

NameDescription
Name—
TaskName UnicodeString—
QueuedTaskInstanceId GUID—
RunningTaskInstanceId GUID—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 324,
    "version": 0,
    "level": 3,
    "task": 324,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T01:41:42.776465+00:00",
    "event_record_id": 999,
    "correlation": {
      "ActivityID": "A0104592-5DBE-4AC7-B2A0-2CB2CC5B61A3"
    },
    "execution": {
      "process_id": 1392,
      "thread_id": 12756
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "NewInstanceQueued",
    "TaskName": "\\microsoft\\windows\\applicationdata\\appuriverifierinstall",
    "QueuedTaskInstanceId": "A0104592-5DBE-4AC7-B2A0-2CB2CC5B61A3",
    "RunningTaskInstanceId": "B5155744-8897-4FDF-AC62-B9A099F510CF"
  },
  "message": ""
}

References #

Event ID 325 — Task Scheduler queued instance "TaskName" of task "Name".

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Warning
Collection Priority
Recommended (Yamato Security)
Task
Launchrequestqueued

Description

Task Scheduler queued instance "TaskName" of task "Name".

Message #

Task Scheduler queued instance "%2"  of task "%1".

Fields #

NameDescription
Name—
TaskName UnicodeString—
QueuedTaskInstanceId GUID—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 325,
    "version": 0,
    "level": 3,
    "task": 325,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T00:55:40.184688+00:00",
    "event_record_id": 895,
    "correlation": {
      "ActivityID": "8C63C2B3-9A13-4121-9DF4-C0123018D079"
    },
    "execution": {
      "process_id": 1392,
      "thread_id": 12608
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "TaskInstanceQueued",
    "TaskName": "\\Avira_Security_Systray",
    "QueuedTaskInstanceId": "8C63C2B3-9A13-4121-9DF4-C0123018D079"
  },
  "message": ""
}

References #

Event ID 326 — Task Scheduler did not launch task "TaskName" because computer is running on batteries.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Launchconditionnotmet,computeronbatteries

Description

Task Scheduler did not launch task "TaskName" because computer is running on batteries. User Action: If launching the task on batteries is required, change the respective flag in the task configuration.

Message #

Task Scheduler did not launch task "%1"  because computer is running on batteries. User Action: If launching the task on batteries is required, change the respective flag in the task configuration.

Fields #

NameDescription
TaskName UnicodeString—

Event ID 327 — Task Scheduler stopped instance "TaskInstanceId" of task "TaskName" because the computer is switching to battery power.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Taskstoppingduetoswitchingtobatteries

Description

Task Scheduler stopped instance "TaskInstanceId" of task "TaskName" because the computer is switching to battery power.

Message #

Task Scheduler stopped instance "%2"  of task "%1"  because the computer is switching to battery power.

Fields #

NameDescription
TaskName UnicodeString—
TaskInstanceId GUID—

Event ID 328 — Task Scheduler stopped instance "TaskName" of task "Name" because computer is no longer idle.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Informational
Collection Priority
Recommended (Yamato Security)
Task
Taskstoppingduetocomputernotidle

Description

Task Scheduler stopped instance "TaskName" of task "Name" because computer is no longer idle.

Message #

Task Scheduler stopped instance "%2"  of task "%1"  because computer is no longer idle.

Fields #

NameDescription
Name—
TaskName UnicodeString—
TaskInstanceId GUID—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 328,
    "version": 0,
    "level": 4,
    "task": 328,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-09T00:55:21.200143+00:00",
    "event_record_id": 31697,
    "correlation": {
      "ActivityID": "1D9CAE68-87E2-4B98-9413-7A44D523E01F"
    },
    "execution": {
      "process_id": 1972,
      "thread_id": 1088
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "StoppingOnIdleEnd",
    "TaskName": "\\Microsoft\\Windows\\MemoryDiagnostic\\RunFullMemoryDiagnostic",
    "TaskInstanceId": "1D9CAE68-87E2-4B98-9413-7A44D523E01F"
  },
  "message": ""
}

Event ID 329 — Task Scheduler terminated "TaskName" instance of the "Name" task due to exceeding the time allocated for execution, as configured in the task definition.

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Informational
Collection Priority
Recommended (Yamato Security)
Task
Taskstoppingduetotimeoutreached

Message #

Task Scheduler terminated "%2"  instance of the "%1"  task due to exceeding the time allocated for execution, as configured in the task definition. User Action: Increase the configured task timeout or investigate external reasons for the delay.

Fields #

NameDescription
Name—
TaskName UnicodeString—
TaskInstanceId GUID—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 329,
    "version": 0,
    "level": 4,
    "task": 329,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T00:39:49.792094+00:00",
    "event_record_id": 825,
    "correlation": {
      "ActivityID": "83261A6E-4DC3-414F-BFB6-8B4046A8C7BC"
    },
    "execution": {
      "process_id": 1392,
      "thread_id": 12576
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "StoppedOnTimeout",
    "TaskName": "\\Microsoft\\Windows\\Flighting\\OneSettings\\RefreshCache",
    "TaskInstanceId": "83261A6E-4DC3-414F-BFB6-8B4046A8C7BC"
  },
  "message": ""
}

References #

Event ID 330 — Task Scheduler stopped instance "TaskName" of task "Name" as request by user "TaskInstanceId" .

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Informational
Collection Priority
Recommended (Yamato Security)
Task
Taskstoppingduetouserrequest

Description

Task Scheduler stopped instance "TaskName" of task "Name" as request by user "TaskInstanceId" .

Message #

Task Scheduler stopped instance "%2"  of task "%1"  as request by user "%3" .

Fields #

NameDescription
Name—
TaskName UnicodeString—
TaskInstanceId GUID—
UserContext UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 330,
    "version": 0,
    "level": 4,
    "task": 330,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2022-04-07T17:04:28.074982+00:00",
    "event_record_id": 581,
    "correlation": {
      "ActivityID": "F3FE9E7B-2EAA-4ADC-A87D-F751736AF46C"
    },
    "execution": {
      "process_id": 1528,
      "thread_id": 1832
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "StoppedOnRequest",
    "TaskName": "\\Microsoft\\Windows\\Windows Defender\\Windows Defender Scheduled Scan",
    "TaskInstanceId": "F3FE9E7B-2EAA-4ADC-A87D-F751736AF46C",
    "UserContext": "NT AUTHORITY\\SYSTEM"
  },
  "message": ""
}

References #

Event ID 331 — Task Scheduler will continue to execute Instance "TaskInstanceId" of task "TaskName" even after the designated timeout, due to a failure to create the timeout mechan...

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Taskfailedtostopontimeout

Description

Task Scheduler will continue to execute Instance "TaskInstanceId" of task "TaskName" even after the designated timeout, due to a failure to create the timeout mechanism. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler will continue to execute Instance "%2"  of task "%1"  even after the designated timeout, due to a failure to create the timeout mechanism. Additional Data: Error Value: %3.

Fields #

NameDescription
TaskName UnicodeString—
TaskInstanceId GUID—
ResultCode UInt32—

Event ID 332 — Task Scheduler did not launch task "Name" because user "TaskName" was not logged on when the launching conditions were met.

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Warning
Collection Priority
Recommended (Yamato Security)
Task
Launchconditionnotmet,usernotlogged_on

Message #

Task Scheduler did not launch task "%1"  because user "%2" was not logged on when the launching conditions were met. User Action: Ensure user is logged on or change the task definition to allow launching when user is logged off.

Fields #

NameDescription
Name—
TaskName UnicodeString—
UserName UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 332,
    "version": 0,
    "level": 3,
    "task": 332,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T01:13:11.824978+00:00",
    "event_record_id": 956,
    "correlation": {},
    "execution": {
      "process_id": 1392,
      "thread_id": 14508
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "NoStartUserNotLogged",
    "TaskName": "\\Microsoft\\VisualStudio\\Updates\\BackgroundDownload",
    "UserName": "WINDEV2310EVAL\\Administrator"
  },
  "message": ""
}

References #

Event ID 333 — Task Scheduler did not launch task "TaskName" because target session is RemoteApp session.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Launchconditionnotmet,sessionisRemoteAppSession

Message #

Task Scheduler did not launch task "%1"  because target session is RemoteApp session. User Action: If launching the task on RemoteApp sessions is required, change the respective flag in the task configuration.

Fields #

NameDescription
TaskName UnicodeString—

Event ID 334 — Task Scheduler did not launch task "TaskName" because target session is a WORKER session.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Launchconditionnotmet,sessionisaWorkerSession

Description

Task Scheduler did not launch task "TaskName" because target session is a WORKER session.

Message #

Task Scheduler did not launch task "%1"  because target session is a WORKER session.

Fields #

NameDescription
TaskName UnicodeString—

Event ID 400 — Task Scheduler service has started.

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Informational
Collection Priority
Recommended (Yamato Security)
Task
Servicestarted
Opcode
Start

Description

Task Scheduler service has started.

Message #

Task Scheduler service has started.

Fields #

NameDescription
Name—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 400,
    "version": 0,
    "level": 4,
    "task": 400,
    "opcode": 1,
    "keywords": 9223372036854775808,
    "time_created": "2022-04-07T16:53:13.896426+00:00",
    "event_record_id": 407,
    "correlation": {},
    "execution": {
      "process_id": 1528,
      "thread_id": 1544
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "ServiceStartEvent"
  },
  "message": ""
}

References #

Event ID 401 — Task Scheduler service failed to start due to an error in "ErrorDescription" .

Provider
Microsoft-Windows-TaskScheduler
Channel
System
Task
Servicefailedtostart
Opcode
LaunchFailure

Description

Task Scheduler service failed to start due to an error in "ErrorDescription" . Additional Data: Error Value: ResultCode.

Message #

Task Scheduler service failed to start due to an error in "%1" . Additional Data: Error Value: %2.

Fields #

NameDescription
ErrorDescription UnicodeString—
ResultCode UInt32—

Event ID 402 — Task Scheduler service is shutting down.

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Informational
Collection Priority
Recommended (Yamato Security)
Task
Serviceisshuttingdown
Opcode
Stop

Description

Task Scheduler service is shutting down.

Message #

Task Scheduler service is shutting down.

Fields #

NameDescription
Name—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 402,
    "version": 0,
    "level": 4,
    "task": 402,
    "opcode": 2,
    "keywords": 9223372036854775808,
    "time_created": "2022-04-07T08:38:25.808031+00:00",
    "event_record_id": 405,
    "correlation": {},
    "execution": {
      "process_id": 1536,
      "thread_id": 1644
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "ServiceStopEvent"
  },
  "message": ""
}

References #

Event ID 403 — Task Scheduler service has encountered an error in "ErrorDescription" .

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Servicecriticalerror
Opcode
Failure

Description

Task Scheduler service has encountered an error in "ErrorDescription" . Additional Data: Error Value: ResultCode.

Message #

Task Scheduler service has encountered an error in "%1" . Additional Data: Error Value: %2.

Fields #

NameDescription
ErrorDescription UnicodeString—
ResultCode UInt32—

Event ID 404 — Task Scheduler service has encountered RPC initialization error in "ErrorDescription".

Provider
Microsoft-Windows-TaskScheduler
Channel
System
Task
ServiceRPCerror

Description

Task Scheduler service has encountered RPC initialization error in "ErrorDescription". Additional Data: Error Value: ResultCode.

Message #

Task Scheduler service has encountered RPC initialization error in "%1". Additional Data: Error Value: %2.

Fields #

NameDescription
ErrorDescription UnicodeString—
ResultCode UInt32—

Event ID 405 — Task Scheduler service has failed to initialize COM.

Provider
Microsoft-Windows-TaskScheduler
Channel
System
Task
ServiceCOMerror

Description

Task Scheduler service has failed to initialize COM. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler service has failed to initialize COM. Additional Data: Error Value: %1.

Fields #

NameDescription
ResultCode UInt32—

Event ID 406 — Task Scheduler service failed to initialize credentials store.

Provider
Microsoft-Windows-TaskScheduler
Channel
System
Task
Credstoreinitializationerror

Description

Task Scheduler service failed to initialize credentials store. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler service failed to initialize credentials store. Additional Data: Error Value: %1.

Fields #

NameDescription
ResultCode UInt32—

Event ID 407 — Task Scheduler service failed to initialize LSA.

Provider
Microsoft-Windows-TaskScheduler
Channel
System
Task
LSAinitializationerror

Description

Task Scheduler service failed to initialize LSA. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler service failed to initialize LSA. Additional Data: Error Value: %1.

Fields #

NameDescription
ResultCode UInt32—

Event ID 408 — Task Scheduler service failed to initialize idle state detection module.

Provider
Microsoft-Windows-TaskScheduler
Channel
System
Task
Idledetectionerror

Description

Task Scheduler service failed to initialize idle state detection module. Idle tasks may not be started as required. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler service failed to initialize idle state detection module. Idle tasks may not be started as required. Additional Data: Error Value: %1.

Fields #

NameDescription
ResultCode UInt32—

Event ID 409 — Task Scheduler service failed to initialize time change notification.

Provider
Microsoft-Windows-TaskScheduler
Channel
System
Task
Timechangenotificationerror

Description

Task Scheduler service failed to initialize time change notification. System time updates may not be picked by the service and task schedules may not be updated. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler service failed to initialize time change notification. System time updates may not be picked by the service and task schedules may not be updated. Additional Data: Error Value: %1.

Fields #

NameDescription
ResultCode UInt32—

Event ID 410 — Task Scheduler service failed to set a wakeup timer.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Wakeuptimererror

Description

Task Scheduler service failed to set a wakeup timer. As a result, some scheduled tasks may not run while the system is suspended. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler service failed to set a wakeup timer. As a result, some scheduled tasks may not run while the system is suspended. Additional Data: Error Value: %1.

Fields #

NameDescription
ResultCode UInt32—

Event ID 411 — Task Scheduler service received a time system change notification.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Informational
Collection Priority
Recommended (Yamato Security)
Task
Servicesignaledtimechange

Description

Task Scheduler service received a time system change notification.

Message #

Task Scheduler service received a time system change notification.

Fields #

NameDescription
Name—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 411,
    "version": 0,
    "level": 4,
    "task": 411,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-08T23:13:40.513605+00:00",
    "event_record_id": 30045,
    "correlation": {},
    "execution": {
      "process_id": 2316,
      "thread_id": 2468
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "TimeChangeSignaled"
  },
  "message": ""
}

Event ID 412 — Task Scheduler service failed to launch tasks triggered by computer startup.

Provider
Microsoft-Windows-TaskScheduler
Channel
System
Task
Servicecriticalerror

Description

Task Scheduler service failed to launch tasks triggered by computer startup. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler service failed to launch tasks triggered by computer startup. Additional Data: Error Value: %1.

Fields #

NameDescription
ResultCode UInt32—

Event ID 413 — Task Scheduler service failed to load tasks at service startup.

Provider
Microsoft-Windows-TaskScheduler
Channel
System
Task
Servicecriticalerror

Description

Task Scheduler service failed to load tasks at service startup. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler service failed to load tasks at service startup. Additional Data: Error Value: %1.

Fields #

NameDescription
ResultCode UInt32—

Event ID 414 — Task Scheduler service found a misconfiguration in the TaskName definition.

Provider
Microsoft-Windows-TaskScheduler
Channel
System
Task
TaskMisconfiguration

Description

Task Scheduler service found a misconfiguration in the TaskName definition. Additional Data: Error Value: Parameter.

Message #

Task Scheduler service found a misconfiguration in the %1 definition. Additional Data: Error Value: %2.

Fields #

NameDescription
TaskName UnicodeString—
Parameter UnicodeString—

Event ID 500 — Process ID ProcessId has registered idle task ID IdleTaskId.

Provider
Microsoft-Windows-TaskScheduler
Channel
Diagnostic
Task
IdleTaskRegister

Description

Process ID ProcessId has registered idle task ID IdleTaskId.

Message #

Process ID %2 has registered idle task ID %1.

Fields #

NameDescription
IdleTaskId UInt32—
ProcessId UInt32—

Event ID 501 — Process ID ProcessId has completed idle task ID IdleTaskId.

Provider
Microsoft-Windows-TaskScheduler
Channel
Diagnostic
Task
IdleTaskUnregister

Description

Process ID ProcessId has completed idle task ID IdleTaskId.

Message #

Process ID %2 has completed idle task ID %1.

Fields #

NameDescription
IdleTaskId UInt32—
ProcessId UInt32—

Event ID 502 — Execution of idle task ID IdleTaskId has started.

Provider
Microsoft-Windows-TaskScheduler
Channel
Diagnostic
Task
IdleTaskExecute
Opcode
Start

Description

Execution of idle task ID IdleTaskId has started.

Message #

Execution of idle task ID %1 has started.

Fields #

NameDescription
IdleTaskId UInt32—
ProcessId UInt32—

Event ID 503 — Execution of idle task ID IdleTaskId has ended.

Provider
Microsoft-Windows-TaskScheduler
Channel
Diagnostic
Task
IdleTaskExecute
Opcode
Stop

Description

Execution of idle task ID IdleTaskId has ended.

Message #

Execution of idle task ID %1 has ended.

Fields #

NameDescription
IdleTaskId UInt32—
ProcessId UInt32—

Event ID 504 — Idle task ID IdleTaskId has been notified that explicit processing has been requested.

Provider
Microsoft-Windows-TaskScheduler
Channel
Diagnostic
Task
IdleTaskNotify
Opcode
Start

Description

Idle task ID IdleTaskId has been notified that explicit processing has been requested.

Message #

Idle task ID %1 has been notified that explicit processing has been requested.

Fields #

NameDescription
IdleTaskId UInt32—
ProcessId UInt32—

Event ID 505 — Idle task ID IdleTaskId has returned from its explicit processing notification.

Provider
Microsoft-Windows-TaskScheduler
Channel
Diagnostic
Task
IdleTaskNotify
Opcode
Stop

Description

Idle task ID IdleTaskId has returned from its explicit processing notification.

Message #

Idle task ID %1 has returned from its explicit processing notification.

Fields #

NameDescription
IdleTaskId UInt32—
ProcessId UInt32—

Event ID 506 — Explicit execution of all idle tasks has been requested.

Provider
Microsoft-Windows-TaskScheduler
Channel
Diagnostic
Task
IdleTaskExplicitProcessing
Opcode
Start

Description

Explicit execution of all idle tasks has been requested.

Message #

Explicit execution of all idle tasks has been requested.

Event ID 507 — Explicit execution of all idle tasks has completed.

Provider
Microsoft-Windows-TaskScheduler
Channel
Diagnostic
Task
IdleTaskExplicitProcessing
Opcode
Stop

Description

Explicit execution of all idle tasks has completed.

Message #

Explicit execution of all idle tasks has completed.

Event ID 508 — Explicit execution of all idle tasks is in progress.

Provider
Microsoft-Windows-TaskScheduler
Channel
Diagnostic
Task
IdleTaskExplicitProcessingActive

Description

Explicit execution of all idle tasks is in progress.

Message #

Explicit execution of all idle tasks is in progress.

Event ID 509 — Idle Task Power Notification Received: NotificationType (State).

Provider
Microsoft-Windows-TaskScheduler
Channel
Diagnostic
Task
IdleTaskPowerNotificationReceived

Description

Idle Task Power Notification Received: NotificationType (State).

Message #

Idle Task Power Notification Received: %1 (%2)

Fields #

NameDescription
NotificationType UnicodeString—
State UInt32—

Event ID 510 —

Provider
Microsoft-Windows-TaskScheduler
Channel
Diagnostic
Task
IdleTaskPerfTrackResourceConsumption

Fields #

NameDescription
NoIdleReason UInt32—
DATA1 UInt32—
DATA2 UInt32—

Event ID 511 —

Provider
Microsoft-Windows-TaskScheduler
Channel
Diagnostic
Task
IdleTaskPerfTrackIdleExit

Fields #

NameDescription
TimeSinceUserNotPresent UInt32—
DATA UInt32—

Event ID 512 — Idle check point: State DetectionResult, Reason Reason.

Provider
Microsoft-Windows-TaskScheduler
Channel
Diagnostic
Task
IdleCheckPoint

Description

Idle check point: State DetectionResult, Reason Reason.

Message #

Idle check point: State %1, Reason %2.

Fields #

NameDescription
DetectionResult UInt32—
Reason UInt32—

Event ID 700 — Task Scheduler service started Task Compatibility module.

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Level
Informational
Collection Priority
Recommended (Yamato Security)
Task
Compatibilitymodulestarted

Description

Task Scheduler service started Task Compatibility module.

Message #

Task Scheduler service started Task Compatibility module.

Fields #

NameDescription
Name—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 700,
    "version": 0,
    "level": 4,
    "task": 700,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2022-04-07T16:53:13.090470+00:00",
    "event_record_id": 406,
    "correlation": {},
    "execution": {
      "process_id": 1528,
      "thread_id": 1544
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "CompatibilityAdapterLaunch"
  },
  "message": ""
}

References #

Event ID 701 — Task Scheduler service failed to start Task Compatibility module.

Provider
Microsoft-Windows-TaskScheduler
Channel
System
Task
Compatibilitymodulefailedtostart

Description

Task Scheduler service failed to start Task Compatibility module. Tasks may not be able to register on previous Window versions. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler service failed to start Task Compatibility module. Tasks may not be able to register on previous Window versions. Additional Data: Error Value: %1.

Fields #

NameDescription
ResultCode UInt32—

Event ID 702 — Task Scheduler failed to initialize the RPC server for starting the Task Compatibility module.

Provider
Microsoft-Windows-TaskScheduler
Channel
System
Task
CompatibilitymoduleRPCfailed

Description

Task Scheduler failed to initialize the RPC server for starting the Task Compatibility module. Tasks may not be able to register on previous Window versions. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler failed to initialize the RPC server for starting the Task Compatibility module. Tasks may not be able to register on previous Window versions. Additional Data: Error Value: %1.

Fields #

NameDescription
ResultCode UInt32—

Event ID 703 — Task Scheduler failed to initialize Net Schedule API for starting the Task Compatibility module.

Provider
Microsoft-Windows-TaskScheduler
Channel
System
Task
CompatibilitymoduleNetScheduleAPIfailed

Description

Task Scheduler failed to initialize Net Schedule API for starting the Task Compatibility module. Tasks may not be able to register on previous Window versions. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler failed to initialize Net Schedule API for starting the Task Compatibility module. Tasks may not be able to register on previous Window versions. Additional Data: Error Value: %1.

Fields #

NameDescription
ResultCode UInt32—

Event ID 704 — Task Scheduler failed to initialize LSA for starting the Task Compatibility module.

Provider
Microsoft-Windows-TaskScheduler
Channel
System
Task
CompatibilitymoduleLSAfailed

Description

Task Scheduler failed to initialize LSA for starting the Task Compatibility module. Tasks may not be able to register on previous Window versions. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler failed to initialize LSA for starting the Task Compatibility module. Tasks may not be able to register on previous Window versions. Additional Data: Error Value: %1.

Fields #

NameDescription
ResultCode UInt32—

Event ID 705 — Task Scheduler failed to start directory monitoring for the Task Compatibility module.

Provider
Microsoft-Windows-TaskScheduler
Channel
System
Task
Compatibilitymoduledirectorymonitoringfailed

Description

Task Scheduler failed to start directory monitoring for the Task Compatibility module. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler failed to start directory monitoring for the Task Compatibility module. Additional Data: Error Value: %1.

Fields #

NameDescription
ResultCode UInt32—

Event ID 706 — Task Compatibility module failed to update task "TaskName" to the required status TaskStatus.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Compatibilitymoduletaskstatusupdatefailed

Description

Task Compatibility module failed to update task "TaskName" to the required status TaskStatus. Additional Data: Error Value: ResultCode.

Message #

Task Compatibility module failed to update task "%1"  to the required status %2. Additional Data: Error Value: %3.

Fields #

NameDescription
TaskName UnicodeString—
TaskStatus UInt32—
ResultCode UInt32—

Event ID 707 — Task Compatibility module failed to delete task "TaskName" .

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Compatibilitymoduletaskdeletionfailed

Description

Task Compatibility module failed to delete task "TaskName" . Additional Data: Error Value: ResultCode.

Message #

Task Compatibility module failed to delete task "%1" . Additional Data: Error Value: %2.

Fields #

NameDescription
TaskName UnicodeString—
ResultCode UInt32—

Event ID 708 — Task Compatibility module failed to set security descriptor "SecurityDescriptor" for task "TaskName" .

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Compatibilitymodulesecuritydescriptorfailed

Description

Task Compatibility module failed to set security descriptor "SecurityDescriptor" for task "TaskName" . Additional Data: Error Value: ResultCode.

Message #

Task Compatibility module failed to set security descriptor "%1"  for task "%2" . Additional Data: Error Value: %3.

Fields #

NameDescription
SecurityDescriptor UnicodeString—
TaskName UnicodeString—
ResultCode UInt32—

Event ID 709 — Task Compatibility module failed to update task "TaskName" .

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Compatibilitymoduletaskupdatefailed

Description

Task Compatibility module failed to update task "TaskName" . Additional Data: Error Value: ResultCode.

Message #

Task Compatibility module failed to update task "%1" . Additional Data: Error Value: %2.

Fields #

NameDescription
TaskName UnicodeString—
ResultCode UInt32—

Event ID 710 — Task Compatibility module failed to upgrade existing tasks.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Compatibilitymoduletasksupgradefailed

Description

Task Compatibility module failed to upgrade existing tasks. Upgrade will be attempted again next time 'Task Scheduler' service starts. Additional Data: Error Value: ResultCode.

Message #

Task Compatibility module failed to upgrade existing tasks. Upgrade will be attempted again next time 'Task Scheduler' service starts. Additional Data: Error Value: %1.

Fields #

NameDescription
ResultCode UInt32—

Event ID 711 — Task Compatibility module failed to upgrade NetSchedule account "Account" .

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Compatibilitymoduletasksupgradefailed

Description

Task Compatibility module failed to upgrade NetSchedule account "Account" . Additional Data: Error Value: ResultCode.

Message #

Task Compatibility module failed to upgrade NetSchedule account "%1" . Additional Data: Error Value: %2.

Fields #

NameDescription
Account UnicodeString—
ResultCode UInt32—

Event ID 712 — Task Compatibility module failed to read existing store to upgrade tasks.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Compatibilitymoduletasksupgradefailed

Description

Task Compatibility module failed to read existing store to upgrade tasks. Additional Data: Error Value: ResultCode.

Message #

Task Compatibility module failed to read  existing store to upgrade tasks. Additional Data: Error Value: %1.

Fields #

NameDescription
ResultCode UInt32—

Event ID 713 — Task Compatibility module failed to load task "TaskName" for upgrade.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Compatibilitymoduletasksupgradefailed

Description

Task Compatibility module failed to load task "TaskName" for upgrade. Additional Data: Error Value: ResultCode.

Message #

Task Compatibility module failed to load task  "%1" for upgrade. Additional Data: Error Value: %2.

Fields #

NameDescription
TaskName UnicodeString—
ResultCode UInt32—

Event ID 714 — Task Compatibility module failed to register task "TaskName" for upgrade.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Compatibilitymoduletasksupgradefailed

Description

Task Compatibility module failed to register task "TaskName" for upgrade. Additional Data: Error Value: ResultCode.

Message #

Task Compatibility module failed to register  task  "%1" for upgrade. Additional Data: Error Value: %2.

Fields #

NameDescription
TaskName UnicodeString—
ResultCode UInt32—

Event ID 715 — Task Compatibility module failed to delete LSA store for upgrade.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Compatibilitymoduletasksupgradefailed

Description

Task Compatibility module failed to delete LSA store for upgrade. Additional Data: Error Value: ResultCode.

Message #

Task Compatibility module failed to delete  LSA store for upgrade. Additional Data: Error Value: %1.

Fields #

NameDescription
ResultCode UInt32—

Event ID 716 — Task Compatibility module failed to upgrade existing scheduled tasks.

Provider
Microsoft-Windows-TaskScheduler
Channel
System
Task
Compatibilitymoduletasksupgradefailed

Description

Task Compatibility module failed to upgrade existing scheduled tasks. Additional Data: Error Value: ResultCode.

Message #

Task Compatibility module failed to upgrade existing scheduled tasks. Additional Data: Error Value: %1.

Fields #

NameDescription
ResultCode UInt32—

Event ID 717 — Task Compatibility module failed to determine if upgrade is needed.

Provider
Microsoft-Windows-TaskScheduler
Channel
Operational
Collection Priority
Recommended (Yamato Security)
Task
Compatibilitymoduletasksupgradeundetermined

Description

Task Compatibility module failed to determine if upgrade is needed. Additional Data: Error Value: ResultCode.

Message #

Task Compatibility module failed to determine if upgrade is needed. Additional Data: Error Value: %1.

Fields #

NameDescription
ResultCode UInt32—

Event ID 718 — Task scheduler was unable to upgrade the credential store from the Beta 2 version.

Provider
Microsoft-Windows-TaskScheduler
Channel
System
Task
Credentialstoreupgradefailed

Description

Task scheduler was unable to upgrade the credential store from the Beta 2 version. You may need to re-register any tasks that require passwords. Additional Data: Error Value: ResultCode.

Message #

Task scheduler was unable to upgrade the credential store from the Beta 2 version.  You may need to re-register any tasks that require passwords. Additional Data: Error Value: %1.

Fields #

NameDescription
ResultCode UInt32—

Event ID 719 — To help optimize for performance, Task Scheduler has automatically disabled logging.

Provider
Microsoft-Windows-TaskScheduler
Channel
System
Level
Informational
Task
TaskSchedulerOperationallogwasdisabled

Description

To help optimize for performance, Task Scheduler has automatically disabled logging. To re-enable logging, please use Event Viewer.

Message #

To help optimize for performance, Task Scheduler has automatically disabled logging. To re-enable logging, please use Event Viewer.

Fields #

NameDescription
Name—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 719,
    "version": 0,
    "level": 4,
    "task": 719,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-03-09T00:56:48.593820+00:00",
    "event_record_id": 2099,
    "correlation": {},
    "execution": {
      "process_id": 1780,
      "thread_id": 2060
    },
    "channel": "System",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "OpChannelDisabled"
  },
  "message": ""
}

Event ID 800 — Maintenance state changed to Name (Last Run: hc_stateid).

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Maintenance
Level
Informational
Task
Maintenancestatehaschanged

Description

Maintenance state changed to Name (Last Run: hc_stateid).

Message #

Maintenance state changed to %1 (Last Run: %2).

Fields #

NameDescription
Name—
hc_stateid UInt32—
LastRunDateTime UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 800,
    "version": 0,
    "level": 4,
    "task": 800,
    "opcode": 0,
    "keywords": 576460752303423488,
    "time_created": "2023-11-05T22:27:35.111632+00:00",
    "event_record_id": 20,
    "correlation": {},
    "execution": {
      "process_id": 1880,
      "thread_id": 1568
    },
    "channel": "Microsoft-Windows-TaskScheduler/Maintenance",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "MaintenanceStateChanged",
    "hc_stateid": 1,
    "LastRunDateTime": "‎11/‎5/‎2023 2:27 PM"
  },
  "message": ""
}

References #

Event ID 801 — Maintenance launch operation failed.

Provider
Microsoft-Windows-TaskScheduler
Channel
Maintenance
Task
Maintenancelaunchfailed

Description

Maintenance launch operation failed. Additional error info: ErrorCode.

Message #

Maintenance launch operation failed. Additional error info: %1.

Fields #

NameDescription
ErrorCode UInt32—

Event ID 802 — Maintenance re-configuration failed.

Provider
Microsoft-Windows-TaskScheduler
Channel
Maintenance
Task
Maintenancere_configurationfailed

Description

Maintenance re-configuration failed. Additional error info: ErrorCode.

Message #

Maintenance re-configuration failed. Additional error info: %1.

Fields #

NameDescription
ErrorCode UInt32—

Event ID 803 — Maintenance Scheduler engine task "Task" cannot be accessed.

Provider
Microsoft-Windows-TaskScheduler
Channel
Maintenance
Task
MaintenanceSchedulerenginetaskerror

Description

Maintenance Scheduler engine task "Task" cannot be accessed. Additional error info: ErrorCode.

Message #

Maintenance Scheduler engine task "%1" cannot be accessed. Additional error info: %2.

Fields #

NameDescription
Task UnicodeString—
ErrorCode UInt32—

Event ID 804 — Maintenance Scheduler has detected cyclic dependency for the following maintenance tasks: Task.

Provider
Microsoft-Windows-TaskScheduler
Channel
Maintenance
Task
Maintenancetaskcycledependencydetected

Description

Maintenance Scheduler has detected cyclic dependency for the following maintenance tasks: Task.

Message #

Maintenance Scheduler has detected cyclic dependency for the following maintenance tasks: %1.

Fields #

NameDescription
Task UnicodeString—

Event ID 805 — Maintenance Task "Task" is behind deadline.

Provider
Microsoft-Windows-TaskScheduler
Channel
Maintenance
Task
Maintenancetaskisbehinddeadline

Description

Maintenance Task "Task" is behind deadline.

Message #

Maintenance Task "%1" is behind deadline.

Fields #

NameDescription
Task UnicodeString—

Event ID 806 — Maintenance task "Task" processing error.

Provider
Microsoft-Windows-TaskScheduler
Channel
Maintenance
Task
Maintenancetaskprocessingerror

Description

Maintenance task "Task" processing error. Additional error info InfoCode.

Message #

Maintenance task "%1" processing error. Additional error info %2.

Fields #

NameDescription
Task UnicodeString—
InfoCode UInt32—

Event ID 807 — Maintenance complete (launch type LauncherId).

Provider
Microsoft-Windows-TaskScheduler
Channel
Maintenance
Task
Maintenancecomplete

Description

Maintenance complete (launch type LauncherId).

Message #

Maintenance complete (launch type %1).

Fields #

NameDescription
LauncherId UInt32—

Event ID 808 — Maintenance Task "Name" requests computer wakeup during next regular maintenance run.

#
Provider
Microsoft-Windows-TaskScheduler
Channel
Maintenance
Level
Warning
Task
Maintenancewakeuprequested

Description

Maintenance Task "Name" requests computer wakeup during next regular maintenance run.

Message #

Maintenance Task "%1" requests computer wakeup during next regular maintenance run.

Fields #

NameDescription
Name—
Task UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 808,
    "version": 0,
    "level": 3,
    "task": 808,
    "opcode": 0,
    "keywords": 576460752303423488,
    "time_created": "2023-10-26T04:22:01.225790+00:00",
    "event_record_id": 5,
    "correlation": {},
    "execution": {
      "process_id": 1860,
      "thread_id": 2172
    },
    "channel": "Microsoft-Windows-TaskScheduler/Maintenance",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "MaintenanceTaskWakeupRequested",
    "Task": "NT TASK\\Microsoft\\Windows\\.NET Framework\\.NET Framework NGEN v4.0.30319 Critical"
  },
  "message": ""
}

References #

Event ID 809 — Maintenance Scheduler Group Policy Settings are not properly specified for "FailureReason".

Provider
Microsoft-Windows-TaskScheduler
Channel
System
Task
MaintenanceSchedulerconfigurationerror

Description

Maintenance Scheduler Group Policy Settings are not properly specified for "FailureReason". Default settings are being used.

Message #

Maintenance Scheduler Group Policy Settings are not properly specified for "%1". Default settings are being used.

Fields #

NameDescription
FailureReason UnicodeString—
Known values
%%2304
An Error occured during Logon.
%%2305
The specified user account has expired.
%%2306
The NetLogon component is not active.
%%2307
Account locked out.
%%2308
The user has not been granted the requested logon type at this machine.
%%2309
The specified account's password has expired.
%%2310
Account currently disabled.
%%2311
Account logon time restriction violation.
%%2312
User not allowed to logon at this computer.
%%2313
Unknown user name or bad password.
%%2314
Domain sid inconsistent.
%%2315
Smartcard logon is required and was not used.

Event ID 998 — DEBUG!

Provider
Microsoft-Windows-TaskScheduler
Channel
Debug
Task
MethodFailure
Opcode
Failure

Description

DEBUG! (File:Line) "Name" failed. (HRESULT).

Message #

DEBUG! (%3:%4) "%1" failed. (%2).

Fields #

NameDescription
Name UnicodeString—
HRESULT UInt32—
File UnicodeString—
Line UInt32—

Event ID 999 — DEBUG!

Provider
Microsoft-Windows-TaskScheduler
Channel
Debug
Task
Debug

Description

DEBUG! "String".

Message #

DEBUG! "%1".

Fields #

NameDescription
String UnicodeString—