What is Task Scheduler?
Task Scheduler is both a Windows service and the MMC console that manages it. It starts programs, scripts and commands without anyone clicking them. Windows depends on it heavily: the Task Scheduler Library holds many built-in tasks under Microsoft\Windows for updates, drive optimization, maintenance and diagnostics. Technicians use it to automate routine work, and they inspect it because malware uses scheduled tasks to keep itself running.
How to open it
- Press Win+R and type
taskschd.msc. - Search Start for Task Scheduler.
- Open Computer Management (
compmgmt.msc) > System Tools > Task Scheduler.
Parts of a task
| Tab | Defines | Examples |
|---|---|---|
| General | Name, the account it runs as, security options | Run whether user is logged on or not; Run with highest privileges (elevated) |
| Triggers | When it runs | On a schedule (one time, daily, weekly, monthly), at log on, at startup, on idle, on an event, on workstation lock or unlock |
| Actions | What it runs | Start a program with arguments, such as a .bat, .cmd or PowerShell script |
| Conditions | Extra requirements | Start only on AC power, only when idle, only if a network is available; wake the computer to run |
| Settings | Behavior on demand, failure or overrun | Allow the task to be run on demand, restart if it fails, stop it if it runs too long |
Create Basic Task is a short wizard for simple jobs; Create Task exposes every tab. The History tab shows each run once Enable All Tasks History is turned on in the Actions pane. A Last Run Result of 0x0 means the action completed successfully.
From the command line
schtasks /query /fo LIST /vlists tasks with full details.schtasks /create /tn "NightlyCleanup" /tr "C:\Scripts\cleanup.bat" /sc daily /st 02:00creates a task that runs every day at 2:00 a.m.schtasks /run /tn "NightlyCleanup"runs it immediately, andschtasks /delete /tn "NightlyCleanup"removes it.- In PowerShell,
Get-ScheduledTask,Register-ScheduledTaskandDisable-ScheduledTaskdo the same jobs.
Troubleshooting scheduled tasks
- The task ran but nothing happened: check whether the run-as account has rights to what the script touches, whether the task needs highest privileges, and whether a script with relative paths needs the Start in folder set.
- It stopped working after a password change: tasks set to run whether the user is logged on or not store that account's password. Update it in the task.
- It never runs on a laptop: the Start the task only if the computer is on AC power condition, which is on by default, blocks it on battery.
- You need proof it ran: enable history, then use Run to test on demand and check the Last Run Result.
Task Scheduler and malware
Scheduled tasks are a common persistence method. Malware creates a task that relaunches it at sign-in, at startup or every few minutes, so it returns after you delete its files or disable its startup entry. During cleanup, look for unfamiliar tasks with random names, tasks with no author or description, and actions that run files from AppData, Temp or ProgramData or launch hidden PowerShell commands. The task definitions themselves are stored in C:\Windows\System32\Tasks.
Task Scheduler on the CompTIA A+ exam
Task Scheduler is one of the MMC tools in Core 2 (220-1202) objective 1.4. Know the taskschd.msc command, the difference between a trigger (when) and an action (what), and the everyday uses: a backup or cleanup script on a schedule, a script at sign-in, a service restart overnight. Cues: a script must run every night with no one signed in, think Task Scheduler with Run whether user is logged on or not; malware keeps coming back after every reboot although it is not in Startup apps, check scheduled tasks and the registry Run keys.