Many activities must occur automatically.
Examples:
- Software Updates
- System Maintenance
- Backups
- Log Cleanup
- Security Scanning
Rather than requiring a user to manually execute these actions, Windows can schedule them to run automatically.
This functionality is provided through Scheduled Tasks.
What Is A Scheduled Task?
A Scheduled Task is an automated action that executes when a specific condition occurs.
Conceptually:
Trigger Occurs
↓
Task Starts
↓
Program Executes
↓
Task Completes
Examples:
02:00 AM
↓
Run Backup Script
User Logs In
↓
Launch Application
Services vs Scheduled Tasks
Students often confuse services and tasks because both can execute without direct user interaction.
The key difference is their execution model.
| Characteristic | Service | Scheduled Task |
|---|---|---|
| Purpose | Provide ongoing functionality | Perform a specific action |
| Execution | Runs continuously | Runs when triggered |
| Lifetime | Usually long-running | Usually short-lived |
| Examples | Defender, WinRM | Backups, Updates |
Conceptually:
Service
=
Waits For Work
Scheduled Task
=
Performs Work
Task Scheduler
Windows manages tasks through:
Task Scheduler
Conceptually:
Task Scheduler
↓
Monitors Triggers
↓
Launches Tasks
Task Scheduler is responsible for:
- Storing tasks
- Monitoring triggers
- Launching programs
- Recording task history
Triggers
Tasks execute when a trigger occurs.
Common examples include:
| Trigger | Example |
|---|---|
| Time | 02:00 AM |
| Startup | System Boot |
| Logon | User Login |
| Event | Specific Event Log Entry |
Example:
System Startup
↓
Trigger Fires
↓
Task Executes
Actions
When a trigger fires, the task performs an action.
Common actions include:
- Launch Program
- Execute Script
- Run PowerShell
- Run Command
Example:
Trigger
↓
Launch PowerShell
↓
Execute Script
Security Context
Tasks execute under a security context.
Examples:
Alice
Administrator
NT AUTHORITY\SYSTEM
Conceptually:
Task
↓
Runs As
↓
Identity
The task inherits the permissions and privileges associated with that identity.
Viewing Tasks
PowerShell:
Get-ScheduledTask
Command Prompt:
schtasks /query
Example:
TaskName
--------
MicrosoftEdgeUpdateTask
Defender Scan
Backup Job
Operators frequently enumerate tasks during investigations.
Task Information
Tasks contain configuration information.
Examples include:
- Task Name
- Trigger
- Action
- Run Account
- Last Run Time
- Next Run Time
Example:
Task Name: Backup Job
Trigger: Daily 02:00
Action: backup.ps1
Run As: SYSTEM
Manual Execution
Tasks can be executed manually.
PowerShell:
Start-ScheduledTask -TaskName "Backup Job"
Command Prompt:
schtasks /run /tn "Backup Job"
This launches the task immediately regardless of its trigger.
Security Considerations
Scheduled Tasks are frequently examined during investigations.
Questions operators commonly ask include:
- What tasks execute automatically?
- Which tasks run as SYSTEM?
- Which tasks execute PowerShell?
- Which tasks execute scripts?
- Which tasks appear unusual?
Scheduled Tasks have historically been a common persistence mechanism.
Common Examples
Examples frequently encountered on Windows systems:
Windows Update
Microsoft Defender Scan
Edge Update
Application Updaters
Enterprise environments often contain many custom tasks.
Operator Perspective
When approaching an unfamiliar Windows system, Operators typically ask:
Inventory
- What tasks exist?
- Which tasks are active?
Triggers
- What causes the task to execute?
- How frequently does it run?
Identity
- Which account executes the task?
- Does it run as SYSTEM?
Actions
- What program executes?
- What script executes?
Security
- Does the task appear unusual?
- Is the task being used for persistence?
- Can the task be abused?
Many investigations eventually involve scheduled task analysis.
Key Takeaways
- Scheduled Tasks automate actions.
- Tasks execute when triggers occur.
- Task Scheduler manages task execution.
- Common triggers include time, startup, logon, and events.
- Tasks execute actions such as programs or scripts.
- Tasks run within a security context.
- Tasks can be viewed and executed manually.
- Scheduled Tasks are commonly used for automation.
- Scheduled Tasks are a common persistence mechanism.
- Understanding Scheduled Tasks is essential for both offensive and defensive operations.
The next lesson explores the Windows Registry and how Windows stores configuration information.