Microsoft-Windows-TaskScheduler

148 events across 5 channels

Event	Title	Channel	Sample
100	Task Scheduler started "UserContext" instance of the "Name" task for user …	Operational	Y
101	Task Scheduler failed to start "Name" task for user "TaskName".	Operational	Y
102	Task Scheduler successfully finished "UserContext" instance of the "Name" task …	Operational	Y
103	Task Scheduler failed to start instance "TaskName" of "Name" task for user …	Operational	Y
104	Task Scheduler failed to log on "UserName" .	Operational	N
105	Task Scheduler failed to impersonate "Context" .	Operational	N
106	User "TaskName" registered Task Scheduler task "Name".	Operational	Y
107	Task Scheduler launched "TaskName" instance of task "Name" due to a time trigger …	Operational	Y
108	Task Scheduler launched "TaskName" instance of task "Name" according to an event …	Operational	Y
109	Task Scheduler launched "TaskName" instance of task "Name" according to a …	Operational	Y
110	Task Scheduler launched "TaskName" instance of task "Name" for user "InstanceId" …	Operational	Y
111	Task Scheduler terminated "TaskName" instance of the "Name" task.	Operational	Y
112	Task Scheduler could not start task "TaskName" because the network was …	Operational	N
113	Task registered task "TaskName" , but not all specified triggers will start the …	Operational	N
114	Task Scheduler could not launch task "Name" as scheduled.	Operational	Y
115	Task Scheduler failed to roll back a transaction when updating or deleting a …	Operational	N
116	Task Scheduler validated the configuration for task "TaskName" , but credentials …	Operational	N
117	Task Scheduler launched "InstanceId" instance of task "TaskName" due to an idle …	Operational	N
118	Task Scheduler launched "TaskName" instance of task "Name" due to system …	Operational	Y
119	Task Scheduler launched "UserName" instance of task "Name" due to user …	Operational	Y
120	Task Scheduler launched "InstanceId" instance of task "TaskName" due to user …	Operational	N
121	Task Scheduler launched "InstanceId" instance of task "TaskName" due to user …	Operational	N
122	Task Scheduler launched "InstanceId" instance of task "TaskName" due to user …	Operational	N
123	Task Scheduler launched "InstanceId" instance of task "TaskName" due to user …	Operational	N
124	Task Scheduler launched "InstanceId" instance of task "TaskName" due to user …	Operational	N
125	Task Scheduler launched "InstanceId" instance of task "TaskName" due to user …	Operational	N
126	Task Scheduler failed to execute task "TaskName" .	Operational	N
127	Task Scheduler failed to execute task "TaskName" due to a shutdown race …	Operational	N
128	Task Scheduler did not launch task "TaskName" , because current time exceeds the …	Operational	N
129	Task Scheduler launch task "Name" , instance "TaskName" with process ID Path.	Operational	Y
130	Task Scheduler failed to start task "TaskName" due to the service being busy.	Operational	N
131	Task Scheduler failed to start task "TaskName" because the number of tasks in …	Operational	N
132	Task Scheduler task launching queue quota is approaching its preset limit of …	Operational	N
133	Task Scheduler failed to start task TaskName" in TaskEngine "TaskEngineName" for …	Operational	N
134	Task Engine "TaskEngineName" for user "UserName" is approaching its preset limit …	Operational	N
135	Task Scheduler could not start task "TaskName" because the machine was not idle.	Operational	N
140	User "TaskName" updated Task Scheduler task "Name".	Operational	Y
141	User "TaskName" deleted Task Scheduler task "Name".	Operational	Y
142	User "TaskName" disabled Task Scheduler task "Name".	Operational	Y
145	Task Scheduler woke up the computer to run a task.	Operational	N
146	Task Scheduler failed to load task "TaskName" at service startup.	Operational	Y
147	Task Scheduler recovered sucessfully the image of task "TaskName" after a …	Operational	N
148	Task Scheduler failed to recover the image of task "TaskName" after a corruption …	Operational	N
149	Task "TaskName" is using a combination of properties that is incompatible with …	Operational	N
150	Task Scheduler failed to subscribe for the event trigger for task "TaskName".	Operational	N
151	Task instantiation failed "TaskName".	Operational	Y
152	Task "TaskName" was re-directed to legacy scheduling engine.	Operational	N
153	Task Scheduler did not launch task "Name" as it missed its schedule.	Operational	Y
155	Task Scheduler is currently waiting on completion of task "TaskPath".	Operational	N
200	Task Scheduler launched action "TaskName" in instance "ActionName" of task …	Operational	Y
201	Task Scheduler successfully completed task "Name" , instance "TaskInstanceId" , …	Operational	Y
202	Task Scheduler failed to complete task "Name" , instance "TaskName" , action …	Operational	Y
203	Task Scheduler failed to launch action "TaskInstanceId" in instance "TaskName" …	Operational	Y
204	Task Scheduler failed to retrieve the event triggering values for task …	Operational	N
205	Task Scheduler failed to match the pattern of events for task "TaskName" .	Operational	N
300	Task Scheduler started Task Engine "TaskEngineName" with process ID ProcessID.	Operational	N
301	Task Scheduler is shutting down Task Engine "TaskEngineName".	Operational	N
303	Task Scheduler is shutting down Task Engine "TaskEngineName" due to an error in …	Operational	N
304	Task Scheduler sent "TaskName" task to Task Engine "TaskEngineName" .	Operational	N
305	Task Scheduler did not send "TaskName" task to Task Engine "TaskEngineName" .	Operational	N
306	For Task Scheduler Task Engine "TaskEngineName" , the thread pool failed to …	Operational	N
307	Task Scheduler service failed to connect to the Task Engine "TaskEngineName" …	Operational	N
308	Task Scheduler connected to the Task Engine "TaskEngineName" process.	Operational	N
309	Task Scheduler TaskCount tasks orphaned during Task Engine "TaskEngineName" …	Operational	N
310	Task Scheduler started Task Engine "TaskEngineName" process.	Operational	N
311	Task Scheduler failed to start Task Engine "TaskEngineName" process due to an …	Operational	N
312	Task Scheduler created the Win32 job object for Task Engine "TaskEngineName" .	Operational	N
313	Task Scheduler channel with Task Engine "TaskEngineName" is ready to send and …	Operational	N
314	Task Scheduler has no tasks running for Task Engine "TaskEngineName" , and the …	Operational	N
315	Task Engine "TaskEngineName" process failed to connect to the Task Scheduler …	Operational	N
316	Task Engine "TaskEngineName" failed to send a message to the Task Scheduler …	Operational	N
317	Task Scheduler started Task Engine "TaskEngineName" process.	Operational	N
318	Task Scheduler shutdown Task Engine "TaskEngineName" process.	Operational	N
319	Task Engine "TaskEngineName" received a message from Task Scheduler service …	Operational	N
320	Task Engine "TaskEngineName" received a message from Task Scheduler service …	Operational	N
322	Task Scheduler did not launch task "Name" because instance "TaskName" of the …	Operational	Y
323	Task Scheduler stopped instance "StoppedTaskInstanceId" of task "TaskName" in …	Operational	N
324	Task Scheduler queued instance "TaskName" of task "Name" and will launch it as …	Operational	Y
325	Task Scheduler queued instance "TaskName" of task "Name".	Operational	Y
326	Task Scheduler did not launch task "TaskName" because computer is running on …	Operational	N
327	Task Scheduler stopped instance "TaskInstanceId" of task "TaskName" because the …	Operational	N
328	Task Scheduler stopped instance "TaskName" of task "Name" because computer is no …	Operational	Y
329	Task Scheduler terminated "TaskName" instance of the "Name" task due to …	Operational	Y
330	Task Scheduler stopped instance "TaskName" of task "Name" as request by user …	Operational	Y
331	Task Scheduler will continue to execute Instance "TaskInstanceId" of task …	Operational	N
332	Task Scheduler did not launch task "Name" because user "TaskName" was not logged …	Operational	Y
333	Task Scheduler did not launch task "TaskName" because target session is …	Operational	N
334	Task Scheduler did not launch task "TaskName" because target session is a WORKER …	Operational	N
400	Task Scheduler service has started.	Operational	Y
401	Task Scheduler service failed to start due to an error in "ErrorDescription" .	System	N
402	Task Scheduler service is shutting down.	Operational	Y
403	Task Scheduler service has encountered an error in "ErrorDescription" .	Operational	N
404	Task Scheduler service has encountered RPC initialization error in …	System	N
405	Task Scheduler service has failed to initialize COM.	System	N
406	Task Scheduler service failed to initialize credentials store.	System	N
407	Task Scheduler service failed to initialize LSA.	System	N
408	Task Scheduler service failed to initialize idle state detection module.	System	N
409	Task Scheduler service failed to initialize time change notification.	System	N
410	Task Scheduler service failed to set a wakeup timer.	Operational	N
411	Task Scheduler service received a time system change notification.	Operational	Y
412	Task Scheduler service failed to launch tasks triggered by computer startup.	System	N
413	Task Scheduler service failed to load tasks at service startup.	System	N
414	Task Scheduler service found a misconfiguration in the TaskName definition.	System	N
500	Process ID ProcessId has registered idle task ID IdleTaskId.	Diagnostic	N
501	Process ID ProcessId has completed idle task ID IdleTaskId.	Diagnostic	N
502	Execution of idle task ID IdleTaskId has started.	Diagnostic	N
503	Execution of idle task ID IdleTaskId has ended.	Diagnostic	N
504	Idle task ID IdleTaskId has been notified that explicit processing has been …	Diagnostic	N
505	Idle task ID IdleTaskId has returned from its explicit processing notification.	Diagnostic	N
506	Explicit execution of all idle tasks has been requested.	Diagnostic	N
507	Explicit execution of all idle tasks has completed.	Diagnostic	N
508	Explicit execution of all idle tasks is in progress.	Diagnostic	N
509	Idle Task Power Notification Received: NotificationType (State).	Diagnostic	N
510	Idle Task PerfTrack Resource Consumption	Diagnostic	N
511	Idle Task PerfTrack Idle Exit	Diagnostic	N
512	Idle check point: State DetectionResult, Reason Reason.	Diagnostic	N
700	Task Scheduler service started Task Compatibility module.	Operational	Y
701	Task Scheduler service failed to start Task Compatibility module.	System	N
702	Task Scheduler failed to initialize the RPC server for starting the Task …	System	N
703	Task Scheduler failed to initialize Net Schedule API for starting the Task …	System	N
704	Task Scheduler failed to initialize LSA for starting the Task Compatibility …	System	N
705	Task Scheduler failed to start directory monitoring for the Task Compatibility …	System	N
706	Task Compatibility module failed to update task "TaskName" to the required …	Operational	N
707	Task Compatibility module failed to delete task "TaskName" .	Operational	N
708	Task Compatibility module failed to set security descriptor "SecurityDescriptor" …	Operational	N
709	Task Compatibility module failed to update task "TaskName" .	Operational	N
710	Task Compatibility module failed to upgrade existing tasks.	Operational	N
711	Task Compatibility module failed to upgrade NetSchedule account "Account" .	Operational	N
712	Task Compatibility module failed to read existing store to upgrade tasks.	Operational	N
713	Task Compatibility module failed to load task "TaskName" for upgrade.	Operational	N
714	Task Compatibility module failed to register task "TaskName" for upgrade.	Operational	N
715	Task Compatibility module failed to delete LSA store for upgrade.	Operational	N
716	Task Compatibility module failed to upgrade existing scheduled tasks.	System	N
717	Task Compatibility module failed to determine if upgrade is needed.	Operational	N
718	Task scheduler was unable to upgrade the credential store from the Beta 2 …	System	N
719	To help optimize for performance, Task Scheduler has automatically disabled …	System	Y
800	Maintenance state changed to Name (Last Run: hc_stateid).	Maintenance	Y
801	Maintenance launch operation failed.	Maintenance	N
802	Maintenance re-configuration failed.	Maintenance	N
803	Maintenance Scheduler engine task "Task" cannot be accessed.	Maintenance	N
804	Maintenance Scheduler has detected cyclic dependency for the following …	Maintenance	N
805	Maintenance Task "Task" is behind deadline.	Maintenance	N
806	Maintenance task "Task" processing error.	Maintenance	N
807	Maintenance complete (launch type LauncherId).	Maintenance	N
808	Maintenance Task "Name" requests computer wakeup during next regular maintenance …	Maintenance	Y
809	Maintenance Scheduler Group Policy Settings are not properly specified for …	System	N
998	DEBUG!	Debug	N
999	DEBUG!	Debug	N

Event ID 100: Task Scheduler started "UserContext" instance of the "Name" task for user "TaskName".

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Also via: realtime ETW trace
Level: Informational
Collection Priority: Recommended (Yamato Security, others)
Task: TaskStarted
Opcode: Start

Description

Task Scheduler started "UserContext" instance of the "Name" task for user "TaskName".

Message #

Task Scheduler started "%3" instance of the "%1" task for user "%2".

Fields #

Name	Description
`TaskName` UnicodeString
`UserContext` UnicodeString
`InstanceId` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}",
    "event_source_name": "",
    "event_id": 100,
    "version": 0,
    "level": 4,
    "task": 100,
    "opcode": 1,
    "keywords": -9223372036854775807,
    "time_created": "2026-06-13T14:08:20.0826406+00:00",
    "event_record_id": 8893,
    "correlation": {
      "ActivityID": "{315D0AE5-E095-4BA8-98CF-B8B7C2E4AD53}"
    },
    "execution": {
      "process_id": 2100,
      "thread_id": 3336
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "TaskName": "\\Microsoft\\Windows\\Workplace Join\\Automatic-Device-Join",
    "UserContext": "NT AUTHORITY\\SYSTEM",
    "InstanceId": "{315d0ae5-e095-4ba8-98cf-b8b7c2e4ad53}"
  },
  "message": "Task Scheduler started \"{315d0ae5-e095-4ba8-98cf-b8b7c2e4ad53}\" instance of the \"\\Microsoft\\Windows\\Workplace Join\\Automatic-Device-Join\" task for user \"NT AUTHORITY\\SYSTEM\"."
}

Event ID 101: Task Scheduler failed to start "Name" task for user "TaskName".

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Level: Error
Collection Priority: Recommended (Yamato Security, others)
Task: TaskStartFailed
Opcode: LaunchFailure

Description

Task Scheduler failed to start "Name" task for user "TaskName". Additional Data: Error Value: UserContext.

Message #

Task Scheduler failed to start "%1" task for user "%2". Additional Data: Error Value: %3.

Fields #

Name	Description
`TaskName` UnicodeString
`UserContext` UnicodeString
`ResultCode` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}",
    "event_source_name": "",
    "event_id": 101,
    "version": 0,
    "level": 2,
    "task": 101,
    "opcode": 101,
    "keywords": -9223372036854775807,
    "time_created": "2026-05-29T01:33:23.8193364+00:00",
    "event_record_id": 6107,
    "correlation": {},
    "execution": {
      "process_id": 2072,
      "thread_id": 2408
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "TaskName": "\\Microsoft\\Windows\\Workplace Join\\Automatic-Device-Join",
    "UserContext": "(default user)",
    "ResultCode": "2147943568"
  },
  "message": "Task Scheduler failed to start \"\\Microsoft\\Windows\\Workplace Join\\Automatic-Device-Join\" task for user \"(default user)\". Additional Data: Error Value: 2147943568."
}

Event ID 102: Task Scheduler successfully finished "UserContext" instance of the "Name" task for user "TaskName".

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Also via: realtime ETW trace
Level: Informational
Collection Priority: Recommended (Yamato Security, others)
Task: Taskcompleted
Opcode: Stop

Description

Task Scheduler successfully finished "UserContext" instance of the "Name" task for user "TaskName".

Message #

Task Scheduler successfully finished "%3" instance of the "%1" task for user "%2".

Fields #

Name	Description
`TaskName` UnicodeString
`UserContext` UnicodeString
`InstanceId` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}",
    "event_source_name": "",
    "event_id": 102,
    "version": 0,
    "level": 4,
    "task": 102,
    "opcode": 2,
    "keywords": -9223372036854775807,
    "time_created": "2026-06-13T14:08:20.3058652+00:00",
    "event_record_id": 8896,
    "correlation": {
      "ActivityID": "{315D0AE5-E095-4BA8-98CF-B8B7C2E4AD53}"
    },
    "execution": {
      "process_id": 2100,
      "thread_id": 3336
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "TaskName": "\\Microsoft\\Windows\\Workplace Join\\Automatic-Device-Join",
    "UserContext": "NT AUTHORITY\\SYSTEM",
    "InstanceId": "{315d0ae5-e095-4ba8-98cf-b8b7c2e4ad53}"
  },
  "message": "Task Scheduler successfully finished \"{315d0ae5-e095-4ba8-98cf-b8b7c2e4ad53}\" instance of the \"\\Microsoft\\Windows\\Workplace Join\\Automatic-Device-Join\" task for user \"NT AUTHORITY\\SYSTEM\"."
}

Event ID 103: Task Scheduler failed to start instance "TaskName" of "Name" task for user "InstanceId" .

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Level: Error
Collection Priority: Recommended (Yamato Security, others)
Task: Actionstartfailed
Opcode: RunFailure

Description

Task Scheduler failed to start instance "TaskName" of "Name" task for user "InstanceId" . Additional Data: Error Value: UserContext.

Message #

Task Scheduler failed to start instance "%2" of "%1"  task for user "%3" . Additional Data: Error Value: %4.

Fields #

Name	Description
`TaskName` UnicodeString
`InstanceId` GUID
`UserContext` UnicodeString
`ResultCode` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}",
    "event_source_name": "",
    "event_id": 103,
    "version": 0,
    "level": 2,
    "task": 103,
    "opcode": 102,
    "keywords": -9223372036854775807,
    "time_created": "2026-06-13T05:40:05.7566555+00:00",
    "event_record_id": 7660,
    "correlation": {
      "ActivityID": "{762E45EA-0D91-4E66-8DF4-8CACEE9415D0}"
    },
    "execution": {
      "process_id": 2100,
      "thread_id": 1432
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "TaskName": "\\Microsoft\\Windows\\International\\Synchronize Language Settings",
    "InstanceId": "{762e45ea-0d91-4e66-8df4-8cacee9415d0}",
    "UserContext": "cell-a\\domainadmin",
    "ResultCode": "2147746053"
  },
  "message": "Task Scheduler failed to start instance \"{762e45ea-0d91-4e66-8df4-8cacee9415d0}\" of \"\\Microsoft\\Windows\\International\\Synchronize Language Settings\"  task for user \"cell-a\\domainadmin\" . Additional Data: Error Value: 2147746053."
}

Event ID 104: Task Scheduler failed to log on "UserName" .

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security, others)
Task: Logonfailure

Description

Task Scheduler failed to log on "UserName" . Failure occurred in "ErrorDescription" . User Action: Ensure the credentials for the task are correctly specified. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler failed to log on "%1" . Failure occurred in "%2" . User Action: Ensure the credentials for the task are correctly specified. Additional Data: Error Value: %3.

Fields #

Name	Description
`UserName` UnicodeString
`ErrorDescription` UnicodeString
`ResultCode` UInt32

Event ID 105: Task Scheduler failed to impersonate "Context" .

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security, others)
Task: Impersonationfailure

Description

Task Scheduler failed to impersonate "Context" . Additional Data: Error Value: ResultCode.

Message #

Task Scheduler failed to impersonate "%1" . Additional Data: Error Value: %2.

Fields #

Name	Description
`Context` UnicodeString
`ResultCode` UInt32

Event ID 106: User "TaskName" registered Task Scheduler task "Name".

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Level: Informational
Collection Priority: Recommended (Microsoft-WEF, others)
Task: Taskregistered

Description

User "TaskName" registered Task Scheduler task "Name".

Message #

User "%2"  registered Task Scheduler task "%1"

Fields #

Name	Description
`TaskName` UnicodeString
`UserContext` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}",
    "event_source_name": "",
    "event_id": 106,
    "version": 0,
    "level": 4,
    "task": 106,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T06:01:41.4530033+00:00",
    "event_record_id": 7743,
    "correlation": {},
    "execution": {
      "process_id": 2100,
      "thread_id": 1676
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "TaskName": "\\Microsoft\\Windows\\Windows Defender\\Windows Defender Scheduled Scan",
    "UserContext": "cell-a\\TELEMETRY-DC-A$"
  },
  "message": "User \"cell-a\\TELEMETRY-DC-A$\"  registered Task Scheduler task \"\\Microsoft\\Windows\\Windows Defender\\Windows Defender Scheduled Scan\""
}

References #

Microsoft Learn https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd363640(v=ws.10)

Event ID 107: Task Scheduler launched "TaskName" instance of task "Name" due to a time trigger condition.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Level: Informational
Collection Priority: Recommended (Yamato Security, others)
Task: Tasktriggeredonscheduler

Description

Task Scheduler launched "TaskName" instance of task "Name" due to a time trigger condition.

Message #

Task Scheduler launched "%2"  instance of task "%1" due to a time trigger condition.

Fields #

Name	Description
`TaskName` UnicodeString
`InstanceId` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}",
    "event_source_name": "",
    "event_id": 107,
    "version": 0,
    "level": 4,
    "task": 107,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T13:45:14.1073764+00:00",
    "event_record_id": 8838,
    "correlation": {
      "ActivityID": "{4E01546D-F8D7-4F69-8DC9-CAE5178D108B}"
    },
    "execution": {
      "process_id": 2100,
      "thread_id": 7932
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "TaskName": "\\MicrosoftEdgeUpdateTaskMachineUA",
    "InstanceId": "{4e01546d-f8d7-4f69-8dc9-cae5178d108b}"
  },
  "message": "Task Scheduler launched \"{4e01546d-f8d7-4f69-8dc9-cae5178d108b}\"  instance of task \"\\MicrosoftEdgeUpdateTaskMachineUA\" due to a time trigger condition."
}

Event ID 108: Task Scheduler launched "TaskName" instance of task "Name" according to an event trigger.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Level: Informational
Collection Priority: Recommended (Yamato Security, others)
Task: Tasktriggeredonevent

Description

Task Scheduler launched "TaskName" instance of task "Name" according to an event trigger.

Message #

Task Scheduler launched "%2"  instance of task "%1"  according to an event trigger.

Fields #

Name	Description
`TaskName` UnicodeString
`InstanceId` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}",
    "event_source_name": "",
    "event_id": 108,
    "version": 0,
    "level": 4,
    "task": 108,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T14:08:20.0772782+00:00",
    "event_record_id": 8891,
    "correlation": {
      "ActivityID": "{315D0AE5-E095-4BA8-98CF-B8B7C2E4AD53}"
    },
    "execution": {
      "process_id": 2100,
      "thread_id": 3336
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "TaskName": "\\Microsoft\\Windows\\Workplace Join\\Automatic-Device-Join",
    "InstanceId": "{315d0ae5-e095-4ba8-98cf-b8b7c2e4ad53}"
  },
  "message": "Task Scheduler launched \"{315d0ae5-e095-4ba8-98cf-b8b7c2e4ad53}\"  instance of task \"\\Microsoft\\Windows\\Workplace Join\\Automatic-Device-Join\"  according to an event trigger."
}

Event ID 109: Task Scheduler launched "TaskName" instance of task "Name" according to a registration trigger.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Level: Informational
Collection Priority: Recommended (Yamato Security, others)
Task: Tasktriggeredbyregistration

Description

Task Scheduler launched "TaskName" instance of task "Name" according to a registration trigger.

Message #

Task Scheduler launched "%2"  instance of task "%1"  according to a registration trigger.

Fields #

Name	Description
`TaskName` UnicodeString
`InstanceId` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 109,
    "version": 0,
    "level": 4,
    "task": 109,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2022-04-07T16:57:17.740121+00:00",
    "event_record_id": 490,
    "correlation": {
      "ActivityID": "D9A56AB9-DA1B-4E8C-ABB6-0297EE74232D"
    },
    "execution": {
      "process_id": 1528,
      "thread_id": 932
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "RegistrationTriggerEvent",
    "TaskName": "\\CreateExplorerShellUnelevatedTask",
    "InstanceId": "D9A56AB9-DA1B-4E8C-ABB6-0297EE74232D"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 110: Task Scheduler launched "TaskName" instance of task "Name" for user "InstanceId" .

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Level: Informational
Collection Priority: Recommended (Yamato Security, others)
Task: Tasktriggeredbyuser

Description

Task Scheduler launched "TaskName" instance of task "Name" for user "InstanceId" .

Message #

Task Scheduler launched "%2"  instance of task "%1"  for user "%3" .

Fields #

Name	Description
`TaskName` UnicodeString
`InstanceId` GUID
`UserContext` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}",
    "event_source_name": "",
    "event_id": 110,
    "version": 0,
    "level": 4,
    "task": 110,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-29T16:32:57.5043898+00:00",
    "event_record_id": 6772,
    "correlation": {
      "ActivityID": "{B1CABF2C-522F-4352-81FE-E652A989531D}"
    },
    "execution": {
      "process_id": 2100,
      "thread_id": 2360
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "TaskName": "\\Microsoft\\Windows\\Workplace Join\\Automatic-Device-Join",
    "InstanceId": "{b1cabf2c-522f-4352-81fe-e652a989531d}",
    "UserContext": "System"
  },
  "message": "Task Scheduler launched \"{b1cabf2c-522f-4352-81fe-e652a989531d}\"  instance of task \"\\Microsoft\\Windows\\Workplace Join\\Automatic-Device-Join\"  for user \"System\" ."
}

References #

Microsoft Learn https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd363721(v=ws.10)

Event ID 111: Task Scheduler terminated "TaskName" instance of the "Name" task.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Level: Informational
Collection Priority: Recommended (Yamato Security, others)
Task: Taskterminated
Opcode: Termination

Description

Task Scheduler terminated "TaskName" instance of the "Name" task.

Message #

Task Scheduler terminated "%2"  instance of the "%1"  task.

Fields #

Name	Description
`TaskName` UnicodeString
`InstanceId` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}",
    "event_source_name": "",
    "event_id": 111,
    "version": 0,
    "level": 4,
    "task": 111,
    "opcode": 103,
    "keywords": -9223372036854775807,
    "time_created": "2026-05-29T08:44:12.4454670+00:00",
    "event_record_id": 6328,
    "correlation": {
      "ActivityID": "{9B5A34F6-ABB2-4FCC-83E4-4589AFF754C1}"
    },
    "execution": {
      "process_id": 2072,
      "thread_id": 5376
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "TaskName": "\\Microsoft\\Windows\\Windows Defender\\Windows Defender Scheduled Scan",
    "InstanceId": "{9b5a34f6-abb2-4fcc-83e4-4589aff754c1}"
  },
  "message": "Task Scheduler terminated \"{9b5a34f6-abb2-4fcc-83e4-4589aff754c1}\"  instance of the \"\\Microsoft\\Windows\\Windows Defender\\Windows Defender Scheduled Scan\"  task."
}

Event ID 112: Task Scheduler could not start task "TaskName" because the network was unavailable.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security, others)
Task: Launchconditionnotmet,networkunavailable

Description

Task Scheduler could not start task "TaskName" because the network was unavailable. User Action: Ensure the computer is connected to the required network as specified in the task. If the task does not require network presence, remove the network condition from the task configuration.

Message #

Task Scheduler could not start task "%1"  because the network was unavailable. User Action: Ensure the computer is connected to the required network as specified in the task. If the task does not require network presence, remove the network condition from the task configuration.

Fields #

Name	Description
`TaskName` UnicodeString

Event ID 113: Task registered task "TaskName" , but not all specified triggers will start the task.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security, others)
Task: Taskregisteredwithoutsometriggers

Description

Task registered task "TaskName" , but not all specified triggers will start the task. User Action: Ensure all the task triggers are valid as configured. Additional Data: Error Value: ResultCode.

Message #

Task registered task "%1" , but not all specified triggers will start the task. User Action: Ensure all the task triggers are valid as configured. Additional Data: Error Value: %2.

Fields #

Name	Description
`TaskName` UnicodeString
`ResultCode` UInt32

Event ID 114: Task Scheduler could not launch task "Name" as scheduled.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Level: Warning
Collection Priority: Recommended (Yamato Security, others)
Task: Missedtaskstarted

Description

Task Scheduler could not launch task "Name" as scheduled. Instance "TaskName" is started now as required by the configuration option to start the task when available, if schedule is missed.

Message #

Task Scheduler could not launch task "%1"  as scheduled. Instance "%2"  is started now as required by the configuration option to start the task when available, if schedule is missed.

Fields #

Name	Description
`TaskName` UnicodeString
`InstanceId` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}",
    "event_source_name": "",
    "event_id": 114,
    "version": 0,
    "level": 3,
    "task": 114,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T05:39:30.9213828+00:00",
    "event_record_id": 7463,
    "correlation": {
      "ActivityID": "{C93EA0EA-CF5F-4E04-A692-49DDD2E1162C}"
    },
    "execution": {
      "process_id": 2100,
      "thread_id": 1212
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "TaskName": "\\Microsoft\\Windows\\UpdateOrchestrator\\USO_UxBroker",
    "InstanceId": "{c93ea0ea-cf5f-4e04-a692-49ddd2e1162c}"
  },
  "message": "Task Scheduler could not launch task \"\\Microsoft\\Windows\\UpdateOrchestrator\\USO_UxBroker\"  as scheduled. Instance \"{c93ea0ea-cf5f-4e04-a692-49ddd2e1162c}\"  is started now as required by the configuration option to start the task when available, if schedule is missed."
}

Event ID 115: Task Scheduler failed to roll back a transaction when updating or deleting a task.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security, others)
Task: Taskupdateordeletionerror

Description

Task Scheduler failed to roll back a transaction when updating or deleting a task. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler failed to roll back a transaction when updating or deleting a task. Additional Data: Error Value: %1.

Fields #

Name	Description
`ResultCode` UInt32

Event ID 116: Task Scheduler validated the configuration for task "TaskName" , but credentials could not be stored.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security, others)
Task: Taskregisteredwithoutcredentials

Description

Task Scheduler validated the configuration for task "TaskName" , but credentials could not be stored. User Action: Re-register the task ensuring the credentials are valid. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler validated the configuration for task "%1" , but credentials could not be stored. User Action: Re-register the task ensuring the credentials are valid. Additional Data: Error Value: %2.

Fields #

Name	Description
`TaskName` UnicodeString
`ResultCode` UInt32

Event ID 117: Task Scheduler launched "InstanceId" instance of task "TaskName" due to an idle condition.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security, others)
Task: TasktriggeredonIdle

Description

Task Scheduler launched "InstanceId" instance of task "TaskName" due to an idle condition.

Message #

Task Scheduler launched "%2"  instance of task "%1"  due to an idle condition.

Fields #

Name	Description
`TaskName` UnicodeString
`InstanceId` GUID

Event ID 118: Task Scheduler launched "TaskName" instance of task "Name" due to system startup.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Level: Informational
Collection Priority: Recommended (Yamato Security, others)
Task: Tasktriggeredbycomputerstartup

Description

Task Scheduler launched "TaskName" instance of task "Name" due to system startup.

Message #

Task Scheduler launched "%2"  instance of task "%1"  due to system startup.

Fields #

Name	Description
`TaskName` UnicodeString
`InstanceId` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}",
    "event_source_name": "",
    "event_id": 118,
    "version": 0,
    "level": 4,
    "task": 118,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T08:33:04.7625040+00:00",
    "event_record_id": 8112,
    "correlation": {
      "ActivityID": "{C30ADDB7-14CB-40BE-8F19-03A7020A4112}"
    },
    "execution": {
      "process_id": 2100,
      "thread_id": 5192
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "TaskName": "\\Microsoft\\Windows\\CertificateServicesClient\\SystemTask",
    "InstanceId": "{c30addb7-14cb-40be-8f19-03a7020a4112}"
  },
  "message": "Task Scheduler launched \"{c30addb7-14cb-40be-8f19-03a7020a4112}\"  instance of task \"\\Microsoft\\Windows\\CertificateServicesClient\\SystemTask\"  due to system startup."
}

Event ID 119: Task Scheduler launched "UserName" instance of task "Name" due to user "TaskName" logon.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Level: Informational
Collection Priority: Recommended (Yamato Security, others)
Task: Tasktriggeredonlogon

Description

Task Scheduler launched "UserName" instance of task "Name" due to user "TaskName" logon.

Message #

Task Scheduler launched "%3"  instance of task "%1" due to user "%2"  logon.

Fields #

Name	Description
`TaskName` UnicodeString
`UserName` UnicodeString
`InstanceId` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}",
    "event_source_name": "",
    "event_id": 119,
    "version": 0,
    "level": 4,
    "task": 119,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T08:33:57.7322438+00:00",
    "event_record_id": 8120,
    "correlation": {
      "ActivityID": "{70265863-4CD2-41E3-8949-1991D2F4FE4E}"
    },
    "execution": {
      "process_id": 2100,
      "thread_id": 5192
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "TaskName": "\\Microsoft\\Windows\\CertificateServicesClient\\UserTask",
    "UserName": "cell-a\\domainadmin",
    "InstanceId": "{70265863-4cd2-41e3-8949-1991d2f4fe4e}"
  },
  "message": "Task Scheduler launched \"{70265863-4cd2-41e3-8949-1991d2f4fe4e}\"  instance of task \"\\Microsoft\\Windows\\CertificateServicesClient\\UserTask\" due to user \"cell-a\\domainadmin\"  logon."
}

Event ID 120: Task Scheduler launched "InstanceId" instance of task "TaskName" due to user "UserName" connecting to the console trigger.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security, others)
Task: Tasktriggeredonlocalconsoleconnect

Description

Task Scheduler launched "InstanceId" instance of task "TaskName" due to user "UserName" connecting to the console trigger.

Message #

Task Scheduler launched "%3"  instance of task "%1"  due to user "%2"  connecting to the console trigger.

Fields #

Name	Description
`TaskName` UnicodeString
`UserName` UnicodeString
`InstanceId` GUID

Event ID 121: Task Scheduler launched "InstanceId" instance of task "TaskName" due to user "UserName" disconnecting from the console trigger.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security, others)
Task: Tasktriggeredonlocalconsoledisconnect

Description

Task Scheduler launched "InstanceId" instance of task "TaskName" due to user "UserName" disconnecting from the console trigger.

Message #

Task Scheduler launched "%3"  instance of task "%1"  due to user "%2"  disconnecting from the console trigger.

Fields #

Name	Description
`TaskName` UnicodeString
`UserName` UnicodeString
`InstanceId` GUID

Event ID 122: Task Scheduler launched "InstanceId" instance of task "TaskName" due to user "UserName" remotely connecting trigger.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security, others)
Task: Tasktriggeredonremoteconsoleconnect

Description

Task Scheduler launched "InstanceId" instance of task "TaskName" due to user "UserName" remotely connecting trigger.

Message #

Task Scheduler launched "%3"  instance of task "%1"  due to user "%2"  remotely connecting trigger.

Fields #

Name	Description
`TaskName` UnicodeString
`UserName` UnicodeString
`InstanceId` GUID

Event ID 123: Task Scheduler launched "InstanceId" instance of task "TaskName" due to user "UserName" remotely disconnecting trigger.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security, others)
Task: Tasktriggeredonremoteconsoledisconnect

Description

Task Scheduler launched "InstanceId" instance of task "TaskName" due to user "UserName" remotely disconnecting trigger.

Message #

Task Scheduler launched "%3"  instance of task "%1"  due to user "%2"  remotely disconnecting trigger.

Fields #

Name	Description
`TaskName` UnicodeString
`UserName` UnicodeString
`InstanceId` GUID

Event ID 124: Task Scheduler launched "InstanceId" instance of task "TaskName" due to user "UserName" locking the computer trigger.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security, others)
Task: Tasktriggeredbylockingtheworkstation

Description

Task Scheduler launched "InstanceId" instance of task "TaskName" due to user "UserName" locking the computer trigger.

Message #

Task Scheduler launched "%3"  instance of task "%1"  due to user "%2"  locking the computer trigger.

Fields #

Name	Description
`TaskName` UnicodeString
`UserName` UnicodeString
`InstanceId` GUID

Event ID 125: Task Scheduler launched "InstanceId" instance of task "TaskName" due to user "UserName" unlocking the computer trigger.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security, others)
Task: Tasktriggeredbyunlockingtheworkstation

Description

Task Scheduler launched "InstanceId" instance of task "TaskName" due to user "UserName" unlocking the computer trigger.

Message #

Task Scheduler launched "%3"  instance of task "%1"  due to user "%2"  unlocking the computer trigger.

Fields #

Name	Description
`TaskName` UnicodeString
`UserName` UnicodeString
`InstanceId` GUID

Event ID 126: Task Scheduler failed to execute task "TaskName" .

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security, others)
Task: Taskrestartedonfailure

Description

Task Scheduler failed to execute task "TaskName" . Attempting to restart. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler failed to execute task "%1" . Attempting to restart. Additional Data: Error Value: %2.

Fields #

Name	Description
`TaskName` UnicodeString
`ResultCode` UInt32

Event ID 127: Task Scheduler failed to execute task "TaskName" due to a shutdown race condition.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security, others)
Task: Taskrestartedonfailure_127

Description

Task Scheduler failed to execute task "TaskName" due to a shutdown race condition. Attempting to restart.

Message #

Task Scheduler failed to execute task "%1"  due to a shutdown race condition. Attempting to restart.

Fields #

Name	Description
`TaskName` UnicodeString

Event ID 128: Task Scheduler did not launch task "TaskName" , because current time exceeds the configured task end time.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security, others)
Task: Launchconditionnotmet,beyondendtime

Description

Task Scheduler did not launch task "TaskName" , because current time exceeds the configured task end time. User Action: Extend the end time boundary for the task if required.

Message #

Task Scheduler did not launch task "%1" , because current time exceeds the configured task end time. User Action: Extend the end time boundary for the task if required.

Fields #

Name	Description
`TaskName` UnicodeString

Event ID 129: Task Scheduler launch task "Name" , instance "TaskName" with process ID Path.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Also via: realtime ETW trace
Level: Informational
Collection Priority: Recommended (Yamato Security, others)
Task: CreatedTaskProcess

Description

Task Scheduler launch task "Name" , instance "TaskName" with process ID Path.

Message #

Task Scheduler launch task "%1" , instance "%2"  with process ID %3.

Fields #

Name	Description	Rules
`TaskName` UnicodeString		20 detection rules
`Path` UnicodeString		13 detection rules
`ProcessID` UInt32
`Priority` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}",
    "event_source_name": "",
    "event_id": 129,
    "version": 0,
    "level": 4,
    "task": 129,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T14:08:20.0823200+00:00",
    "event_record_id": 8892,
    "correlation": {},
    "execution": {
      "process_id": 2100,
      "thread_id": 3336
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "TaskName": "\\Microsoft\\Windows\\Workplace Join\\Automatic-Device-Join",
    "Path": "%SystemRoot%\\System32\\dsregcmd.exe",
    "ProcessID": "5708",
    "Priority": "16384"
  },
  "message": "Task Scheduler launch task \"\\Microsoft\\Windows\\Workplace Join\\Automatic-Device-Join\" , instance \"%SystemRoot%\\System32\\dsregcmd.exe\"  with process ID 5708."
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Path`	contains	`\desktop\`	1 rule	sigma
`Path`	contains	`\downloads\`	1 rule	sigma
`TaskName`	eq	`\Microsoft\DefenderService`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\ATPUpd`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\Application Experience\StartupAppTaskCheck`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\Application Experience\StartupAppTaskCkeck`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\Data Integrity Scan\Data Integrity Update`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\DefenderUPDService`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\IISUpdateService`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\Speech\SpeechModelInstallTask`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\WiMSDFS`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\Windows Defender\Defender Update Service`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\Windows Defender\Service Update`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\Windows Error Reporting\CheckReporting`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\Windows Error Reporting\SubmitReporting`	1 rule	sigma

Detection Rules #

View all rules referencing this event →

Sigma # view in coverage

Scheduled Task Executed From A Suspicious Location source medium: Detects the execution of Scheduled Tasks where the Program being run is located in a suspicious location or it's an unusale program to be run from a Scheduled Task
Scheduled Task Executed Uncommon LOLBIN source medium: Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or where it is an unusual program to be run from a Scheduled Task
Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor - Task Scheduler source high: Hunts for known SVR-specific scheduled task names↳ also matches Event ID 140: User "TaskName" updated Task Scheduler task "Name"., Event ID 141: User "TaskName" deleted Task Scheduler task "Name".

Event ID 130: Task Scheduler failed to start task "TaskName" due to the service being busy.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security, others)
Task: Launchconditionnotmet,servicebusy

Description

Task Scheduler failed to start task "TaskName" due to the service being busy.

Message #

Task Scheduler failed to start task "%1" due to the service being busy.

Fields #

Name	Description
`TaskName` UnicodeString
`ResultCode` UInt32

Event ID 131: Task Scheduler failed to start task "TaskName" because the number of tasks in the task queue exceeding the quota currently configured to CurrentQuota.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security, others)
Task: Launchconditionnotmet,quotaexceeded

Description

Task Scheduler failed to start task "TaskName" because the number of tasks in the task queue exceeding the quota currently configured to CurrentQuota. User Action: Reduce the number of running tasks or increase the configured queue quota.

Message #

Task Scheduler failed to start task "%1" because the number of tasks in the task queue exceeding the quota currently configured to %2. User Action: Reduce the number of running tasks or increase the configured queue quota.

Fields #

Name	Description
`TaskName` UnicodeString
`CurrentQuota` UInt32

Event ID 132: Task Scheduler task launching queue quota is approaching its preset limit of tasks currently configured to CurrentQuota.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security, others)
Task: Launchconditionwarning,quotaapproaching

Description

Task Scheduler task launching queue quota is approaching its preset limit of tasks currently configured to CurrentQuota. User Action: Reduce the number of running tasks or increase the configured queue quota.

Message #

Task Scheduler task launching queue quota is approaching its preset limit of tasks currently configured to %1. User Action: Reduce the number of running tasks or increase the configured queue quota.

Fields #

Name	Description
`CurrentQuota` UInt32

Event ID 133: Task Scheduler failed to start task TaskName" in TaskEngine "TaskEngineName" for user "UserName".

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security, others)
Task: Launchconditionnotmet,quotaexceeded_133

Description

Task Scheduler failed to start task TaskName" in TaskEngine "TaskEngineName" for user "UserName". User Action: Reduce the number of tasks running in the specified user context.

Message #

Task Scheduler failed to start task %1" in TaskEngine "%2"  for user "%3". User Action: Reduce the number of tasks running in the specified user context.

Fields #

Name	Description
`TaskName` UnicodeString
`TaskEngineName` UnicodeString
`UserName` UnicodeString

Event ID 134: Task Engine "TaskEngineName" for user "UserName" is approaching its preset limit of tasks.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security, others)
Task: Launchconditionwarning,quotaapproaching_134

Description

Task Engine "TaskEngineName" for user "UserName" is approaching its preset limit of tasks. User Action: Reduce the number of tasks running in the specified user context.

Message #

Task Engine "%1"  for user "%2" is approaching its preset limit of tasks. User Action: Reduce the number of tasks running in the specified user context.

Fields #

Name	Description
`TaskEngineName` UnicodeString
`UserName` UnicodeString

Event ID 135: Task Scheduler could not start task "TaskName" because the machine was not idle.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security, others)
Task: Launchconditionnotmet,machinenotidle

Description

Task Scheduler could not start task "TaskName" because the machine was not idle.

Message #

Task Scheduler could not start task "%1"  because the machine was not idle.

Fields #

Name	Description
`TaskName` UnicodeString

Event ID 140: User "TaskName" updated Task Scheduler task "Name".

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Level: Informational
Collection Priority: Recommended (Yamato Security, others)
Task: Taskregistrationupdated

Description

User "TaskName" updated Task Scheduler task "Name".

Message #

User "%2"  updated Task Scheduler task "%1"

Fields #

Name	Description
`TaskName` UnicodeString
`UserName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}",
    "event_source_name": "",
    "event_id": 140,
    "version": 0,
    "level": 4,
    "task": 140,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T13:52:57.3163780+00:00",
    "event_record_id": 8859,
    "correlation": {},
    "execution": {
      "process_id": 2100,
      "thread_id": 2680
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "TaskName": "\\Microsoft\\Windows\\SoftwareProtectionPlatform\\SvcRestartTask",
    "UserName": "cell-a\\TELEMETRY-DC-A$"
  },
  "message": "User \"cell-a\\TELEMETRY-DC-A$\"  updated Task Scheduler task \"\\Microsoft\\Windows\\SoftwareProtectionPlatform\\SvcRestartTask\""
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`TaskName`	eq	`\Microsoft\DefenderService`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\ATPUpd`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\Application Experience\StartupAppTaskCheck`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\Application Experience\StartupAppTaskCkeck`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\Data Integrity Scan\Data Integrity Update`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\DefenderUPDService`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\IISUpdateService`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\Speech\SpeechModelInstallTask`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\WiMSDFS`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\Windows Defender\Defender Update Service`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\Windows Defender\Service Update`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\Windows Error Reporting\CheckReporting`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\Windows Error Reporting\SubmitReporting`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStart`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\WindowsDefenderService`	1 rule	sigma

Detection Rules #

View all rules referencing this event →

Sigma # view in coverage

Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor - Task Scheduler source high: Hunts for known SVR-specific scheduled task names↳ also matches Event ID 129: Task Scheduler launch task "Name" , instance "TaskName" with process ID Path., Event ID 141: User "TaskName" deleted Task Scheduler task "Name".

Event ID 141: User "TaskName" deleted Task Scheduler task "Name".

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Level: Informational
Collection Priority: Recommended (Microsoft-WEF, others)
Task: Taskregistrationdeleted

Description

User "TaskName" deleted Task Scheduler task "Name".

Message #

User "%2"  deleted Task Scheduler task "%1"

Fields #

Name	Description	Rules
`TaskName` UnicodeString		7 detection rules
`UserName` UnicodeString		2 detection rules

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}",
    "event_source_name": "",
    "event_id": 141,
    "version": 0,
    "level": 4,
    "task": 141,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T05:51:19.2705622+00:00",
    "event_record_id": 7711,
    "correlation": {},
    "execution": {
      "process_id": 2100,
      "thread_id": 5492
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "TaskName": "\\Microsoft\\Windows\\Windows Defender\\Windows Defender Scheduled Scan",
    "UserName": "NT AUTHORITY\\System"
  },
  "message": "User \"NT AUTHORITY\\System\"  deleted Task Scheduler task \"\\Microsoft\\Windows\\Windows Defender\\Windows Defender Scheduled Scan\""
}

Detection Patterns #

Impact: Service Stop

TaskScheduler Event ID 141: User "TaskName" deleted Task Scheduler task "Name".OREvent ID 142: User "TaskName" disabled Task Scheduler task "Name".

1 rule

Sigma

Important Scheduled Task Deleted or Disabled (source)

frack113

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`TaskName`	contains	`\windows\bitlocker`	1 rule	sigma
`TaskName`	contains	`\windows\exploitguard`	1 rule	sigma
`TaskName`	contains	`\windows\systemrestore\sr`	1 rule	sigma
`TaskName`	contains	`\windows\windows defender\`	1 rule	sigma
`TaskName`	contains	`\windows\windowsbackup\`	1 rule	sigma
`TaskName`	contains	`\windows\windowsupdate\`	1 rule	sigma
`TaskName`	eq	`\Microsoft\DefenderService`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\ATPUpd`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\Application Experience\StartupAppTaskCheck`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\Application Experience\StartupAppTaskCkeck`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\Data Integrity Scan\Data Integrity Update`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\DefenderUPDService`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\IISUpdateService`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\Speech\SpeechModelInstallTask`	1 rule	sigma
`TaskName`	eq	`\Microsoft\Windows\WiMSDFS`	1 rule	sigma

Detection Rules #

View all rules referencing this event →

Sigma # view in coverage

Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor - Task Scheduler source high: Hunts for known SVR-specific scheduled task names↳ also matches Event ID 129: Task Scheduler launch task "Name" , instance "TaskName" with process ID Path., Event ID 140: User "TaskName" updated Task Scheduler task "Name".

References #

Microsoft Learn https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd348535(v=ws.10)

Event ID 142: User "TaskName" disabled Task Scheduler task "Name".

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Level: Informational
Collection Priority: Recommended (Microsoft-WEF, others)
Task: Taskdisabled

Description

User "TaskName" disabled Task Scheduler task "Name".

Message #

User "%2"  disabled Task Scheduler task "%1"

Fields #

Name	Description
`TaskName` UnicodeString
`UserName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 142,
    "version": 0,
    "level": 4,
    "task": 142,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-09T00:56:06.060816+00:00",
    "event_record_id": 31710,
    "correlation": {
      "ActivityID": "973CC99D-202A-4A9A-A6DF-75F5CFD7D7B7"
    },
    "execution": {
      "process_id": 1972,
      "thread_id": 3956
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "TaskDisabled",
    "TaskName": "\\Microsoft\\Windows\\Workplace Join\\Automatic-Device-Join",
    "UserName": "System"
  },
  "message": ""
}

Detection Patterns #

Impact: Service Stop

TaskScheduler Event ID 141: User "TaskName" deleted Task Scheduler task "Name".OREvent ID 142: User "TaskName" disabled Task Scheduler task "Name".

1 rule

Sigma

Important Scheduled Task Deleted or Disabled (source)

frack113

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`TaskName`	contains	`\windows\bitlocker`	1 rule	sigma
`TaskName`	contains	`\windows\exploitguard`	1 rule	sigma
`TaskName`	contains	`\windows\systemrestore\sr`	1 rule	sigma
`TaskName`	contains	`\windows\windows defender\`	1 rule	sigma
`TaskName`	contains	`\windows\windowsbackup\`	1 rule	sigma
`TaskName`	contains	`\windows\windowsupdate\`	1 rule	sigma

Event ID 145: Task Scheduler woke up the computer to run a task.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Tasktriggeredbycomingoutofsuspendmode

Description

Task Scheduler woke up the computer to run a task.

Message #

Task Scheduler woke up the computer to run a task.

Event ID 146: Task Scheduler failed to load task "TaskName" at service startup.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Level: Error
Collection Priority: Recommended (Yamato Security)
Task: Taskloadingatservicestartupfailed

Description

Task Scheduler failed to load task "TaskName" at service startup. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler failed to load task "%1" at service startup. Additional Data: Error Value: %2.

Fields #

Name	Description
`TaskName` UnicodeString
`ResultCode` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "event_id": 146,
    "level": 2,
    "task": 146,
    "opcode": 0,
    "time_created": "2026-05-27T19:31:58.4547923+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-TaskScheduler"
  },
  "event_data": {
    "TaskName": "\\Microsoft\\Windows\\UpdateOrchestrator\\StartOobeAppsScanAfterUpdate",
    "ResultCode": "2147942402"
  }
}

Event ID 147: Task Scheduler recovered sucessfully the image of task "TaskName" after a corruption occured during OS upgrade.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: TaskimagerecoveredafterOSmigration

Description

Task Scheduler recovered sucessfully the image of task "TaskName" after a corruption occured during OS upgrade.

Message #

Task Scheduler recovered sucessfully the image of task "%1" after a corruption occured during OS upgrade.

Fields #

Name	Description
`TaskName` UnicodeString

Event ID 148: Task Scheduler failed to recover the image of task "TaskName" after a corruption occured during OS upgrade.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: TaskimagerecoveringfailedafterOSmigration

Description

Task Scheduler failed to recover the image of task "TaskName" after a corruption occured during OS upgrade. Additional Data: Error Value: 0xResultCode.

Message #

Task Scheduler failed to recover the image of task "%1" after a corruption occured during OS upgrade. Additional Data: Error Value: 0x%2.

Fields #

Name	Description
`TaskName` UnicodeString
`ResultCode` HexInt32

Event ID 149: Task "TaskName" is using a combination of properties that is incompatible with the scheduling engine.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Taskisusingacombinationofpropertiesthatisincompatiblewiththeschedulingengine

Description

Task "TaskName" is using a combination of properties that is incompatible with the scheduling engine.

Message #

Task "%1" is using a combination of properties that is incompatible with the scheduling engine.

Fields #

Name	Description
`TaskName` UnicodeString

Event ID 150: Task Scheduler failed to subscribe for the event trigger for task "TaskName".

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Taskregistrationoneventfailed

Description

Task Scheduler failed to subscribe for the event trigger for task "TaskName". Additional Data: Error Value: ResultCode.

Message #

Task Scheduler failed to subscribe for the event trigger for task "%1". Additional Data: Error Value: %2.

Fields #

Name	Description
`TaskName` UnicodeString
`ResultCode` UInt32

Event ID 151: Task instantiation failed "TaskName".

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Level: Error
Collection Priority: Recommended (Yamato Security)
Task: TaskSchedulerfailedtoinstantiatetaskatservicestartup.

Description

Task instantiation failed "TaskName". Check point: LogPoint. Error Value: ResultCode.

Message #

Task instantiation failed "%1". Check point: %2. Error Value: %3.

Fields #

Name	Description
`TaskName` UnicodeString
`LogPoint` UnicodeString
`ResultCode` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "event_id": 151,
    "level": 2,
    "task": 151,
    "opcode": 0,
    "time_created": "2026-05-27T19:31:58.4547605+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-TaskScheduler"
  },
  "event_data": {
    "TaskName": "\\Microsoft\\Windows\\UpdateOrchestrator\\StartOobeAppsScanAfterUpdate",
    "ResultCode": "2147942402",
    "LogPoint": "Ubpm-RegisterConsumer"
  }
}

Event ID 152: Task "TaskName" was re-directed to legacy scheduling engine.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Taskwasredirectedtolegacyengine

Description

Task "TaskName" was re-directed to legacy scheduling engine.

Message #

Task "%1" was re-directed to legacy scheduling engine.

Fields #

Name	Description
`TaskName` UnicodeString

Event ID 153: Task Scheduler did not launch task "Name" as it missed its schedule.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Level: Warning
Collection Priority: Recommended (Yamato Security)
Task: Missedtaskstartrejected

Description

Task Scheduler did not launch task "Name" as it missed its schedule. Consider using the configuration option to start the task when available, if schedule is missed.

Message #

Task Scheduler did not launch task "%1" as it missed its schedule. Consider using the configuration option to start the task when available, if schedule is missed.

Fields #

Name	Description
`TaskName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 153,
    "version": 0,
    "level": 3,
    "task": 153,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-08T23:13:40.561331+00:00",
    "event_record_id": 30099,
    "correlation": {},
    "execution": {
      "process_id": 2316,
      "thread_id": 9952
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "MissedTaskRejected",
    "TaskName": "\\Microsoft\\Windows\\Security\\Pwdless\\IntelligentPwdlessTask"
  },
  "message": ""
}

Event ID 155: Task Scheduler is currently waiting on completion of task "TaskPath".

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: TaskCompletionPending

Description

Task Scheduler is currently waiting on completion of task "TaskPath".

Message #

Task Scheduler is currently waiting on completion of task "%1".

Fields #

Name	Description
`TaskPath` UnicodeString

Event ID 200: Task Scheduler launched action "TaskName" in instance "ActionName" of task "Name".

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Also via: realtime ETW trace
Level: Informational
Collection Priority: Recommended (NSA, others)
Task: Actionstarted
Opcode: Start

Description

Task Scheduler launched action "TaskName" in instance "ActionName" of task "Name".

Message #

Task Scheduler launched action "%2" in instance "%3" of task "%1".

Fields #

Name	Description
`TaskName` UnicodeString
`ActionName` UnicodeString
`TaskInstanceId` GUID
`EnginePID` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}",
    "event_source_name": "",
    "event_id": 200,
    "version": 1,
    "level": 4,
    "task": 200,
    "opcode": 1,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T14:08:20.0826428+00:00",
    "event_record_id": 8894,
    "correlation": {
      "ActivityID": "{315D0AE5-E095-4BA8-98CF-B8B7C2E4AD53}"
    },
    "execution": {
      "process_id": 2100,
      "thread_id": 3336
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "TaskName": "\\Microsoft\\Windows\\Workplace Join\\Automatic-Device-Join",
    "ActionName": "%SystemRoot%\\System32\\dsregcmd.exe",
    "TaskInstanceId": "{315d0ae5-e095-4ba8-98cf-b8b7c2e4ad53}",
    "EnginePID": "5708"
  },
  "message": "Task Scheduler launched action \"%SystemRoot%\\System32\\dsregcmd.exe\" in instance \"{315d0ae5-e095-4ba8-98cf-b8b7c2e4ad53}\" of task \"\\Microsoft\\Windows\\Workplace Join\\Automatic-Device-Join\"."
}

Detection Patterns #

Execution: Scheduled Task

TaskScheduler Event ID 200: Task Scheduler launched action "TaskName" in instance "ActionName" of task "Name".OREvent ID 201: Task Scheduler successfully completed task "Name" , instance "TaskInstanceId" , action "TaskName" .

1 rule

Splunk

WinEvent Windows Task Scheduler Event Action Started (source)

Michael Haag, Splunk

Event ID 201: Task Scheduler successfully completed task "Name" , instance "TaskInstanceId" , action "TaskName" .

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Also via: realtime ETW trace
Level: Informational
Collection Priority: Recommended (Yamato Security, others)
Task: Actioncompleted
Opcode: Stop

Description

Task Scheduler successfully completed task "Name" , instance "TaskInstanceId" , action "TaskName" .

Message #

Task Scheduler successfully completed task "%1" , instance "%3" , action "%2" .

Fields #

Name	Description
`TaskName` UnicodeString
`TaskInstanceId` GUID
`ActionName` UnicodeString
`ResultCode` UInt32
`EnginePID` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}",
    "event_source_name": "",
    "event_id": 201,
    "version": 2,
    "level": 4,
    "task": 201,
    "opcode": 2,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T14:08:20.3056973+00:00",
    "event_record_id": 8895,
    "correlation": {
      "ActivityID": "{315D0AE5-E095-4BA8-98CF-B8B7C2E4AD53}"
    },
    "execution": {
      "process_id": 2100,
      "thread_id": 3336
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "TaskName": "\\Microsoft\\Windows\\Workplace Join\\Automatic-Device-Join",
    "TaskInstanceId": "{315d0ae5-e095-4ba8-98cf-b8b7c2e4ad53}",
    "ActionName": "%SystemRoot%\\System32\\dsregcmd.exe",
    "ResultCode": "2147942401",
    "EnginePID": "5708"
  },
  "message": "Task Scheduler successfully completed task \"\\Microsoft\\Windows\\Workplace Join\\Automatic-Device-Join\" , instance \"{315d0ae5-e095-4ba8-98cf-b8b7c2e4ad53}\" , action \"%SystemRoot%\\System32\\dsregcmd.exe\" with return code 2147942401."
}

Detection Patterns #

Execution: Scheduled Task

1 rule

Splunk

WinEvent Windows Task Scheduler Event Action Started (source)

Michael Haag, Splunk

Event ID 202: Task Scheduler failed to complete task "Name" , instance "TaskName" , action "TaskInstanceId" .

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Level: Error
Collection Priority: Recommended (Yamato Security)
Task: Actionfailed
Opcode: RunFailure

Description

Task Scheduler failed to complete task "Name" , instance "TaskName" , action "TaskInstanceId" . Additional Data: Error Value: ActionName.

Message #

Task Scheduler failed to complete task "%1" , instance "%2" , action "%3" . Additional Data: Error Value: %4.

Fields #

Name	Description
`TaskName` UnicodeString
`TaskInstanceId` GUID
`ActionName` UnicodeString
`ResultCode` UInt32
`EnginePID` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}",
    "event_source_name": "",
    "event_id": 202,
    "version": 1,
    "level": 2,
    "task": 202,
    "opcode": 102,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T05:40:05.7566532+00:00",
    "event_record_id": 7659,
    "correlation": {
      "ActivityID": "{762E45EA-0D91-4E66-8DF4-8CACEE9415D0}"
    },
    "execution": {
      "process_id": 2100,
      "thread_id": 1432
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "TaskName": "\\Microsoft\\Windows\\International\\Synchronize Language Settings",
    "TaskInstanceId": "{762e45ea-0d91-4e66-8df4-8cacee9415d0}",
    "ActionName": "Sync Language Data From Cloud Task",
    "ResultCode": "2147746053",
    "EnginePID": "2384"
  },
  "message": "Task Scheduler failed to complete task \"\\Microsoft\\Windows\\International\\Synchronize Language Settings\" , instance \"{762e45ea-0d91-4e66-8df4-8cacee9415d0}\" , action \"Sync Language Data From Cloud Task\" . Additional Data: Error Value: 2147746053."
}

Event ID 203: Task Scheduler failed to launch action "TaskInstanceId" in instance "TaskName" of task "Name".

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Level: Error
Collection Priority: Recommended (Yamato Security)
Task: Actionfailedtostart
Opcode: LaunchFailure

Description

Task Scheduler failed to launch action "TaskInstanceId" in instance "TaskName" of task "Name". Additional Data: Error Value: ActionName.

Message #

Task Scheduler failed to launch action "%3" in instance "%2" of task "%1". Additional Data: Error Value: %4.

Fields #

Name	Description
`TaskName` UnicodeString
`TaskInstanceId` GUID
`ActionName` UnicodeString
`ResultCode` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 203,
    "version": 0,
    "level": 2,
    "task": 203,
    "opcode": 101,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T01:06:15.745198+00:00",
    "event_record_id": 928,
    "correlation": {
      "ActivityID": "0EBFF706-5D1E-403C-8FEB-AA1502A28BF9"
    },
    "execution": {
      "process_id": 1392,
      "thread_id": 16668
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "ActionLaunchFailure",
    "TaskName": "\\Microsoft\\Windows\\UpdateOrchestrator\\USO_UxBroker",
    "TaskInstanceId": "0EBFF706-5D1E-403C-8FEB-AA1502A28BF9",
    "ActionName": "%systemroot%\\system32\\MusNotification.exe",
    "ResultCode": 2147942402
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 204: Task Scheduler failed to retrieve the event triggering values for task "TaskName" .

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Taskfailedtostartonevent

Description

Task Scheduler failed to retrieve the event triggering values for task "TaskName" . The event will be ignored. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler failed to retrieve the event triggering values for task "%1" . The event will be ignored. Additional Data: Error Value: %2.

Fields #

Name	Description
`TaskName` UnicodeString
`ResultCode` UInt32

Event ID 205: Task Scheduler failed to match the pattern of events for task "TaskName" .

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Taskfailedtostartoneventpatternmatch

Description

Task Scheduler failed to match the pattern of events for task "TaskName" . The events will be ignored. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler failed to match the pattern of events for task "%1" . The events will be ignored. Additional Data: Error Value: %2.

Fields #

Name	Description
`TaskName` UnicodeString
`ResultCode` UInt32

Event ID 300: Task Scheduler started Task Engine "TaskEngineName" with process ID ProcessID.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Taskenginelaunched
Opcode: Start

Description

Task Scheduler started Task Engine "TaskEngineName" with process ID ProcessID.

Message #

Task Scheduler started Task Engine "%1"  with process ID %2.

Fields #

Name	Description
`TaskEngineName` UnicodeString
`ProcessID` UInt32

Event ID 301: Task Scheduler is shutting down Task Engine "TaskEngineName".

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Taskengineproperlyshutdown
Opcode: Stop

Description

Task Scheduler is shutting down Task Engine "TaskEngineName".

Message #

Task Scheduler is shutting down Task Engine "%1"

Fields #

Name	Description
`TaskEngineName` UnicodeString

Event ID 303: Task Scheduler is shutting down Task Engine "TaskEngineName" due to an error in "ErrorDescription" .

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Taskengineshutdownduetoerror
Opcode: Failure

Description

Task Scheduler is shutting down Task Engine "TaskEngineName" due to an error in "ErrorDescription" . Additional Data: Error Value: ResultCode.

Message #

Task Scheduler is shutting down Task Engine "%1"  due to an error in "%2" .  Additional Data: Error Value: %3.

Fields #

Name	Description
`TaskEngineName` UnicodeString
`ErrorDescription` UnicodeString
`ResultCode` UInt32

Event ID 304: Task Scheduler sent "TaskName" task to Task Engine "TaskEngineName" .

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Tasksenttoengine

Description

Task Scheduler sent "TaskName" task to Task Engine "TaskEngineName" . The task instance Id is "TaskInstanceId" .

Message #

Task Scheduler sent "%1"  task to Task Engine "%2" . The task instance Id is "%3" .

Fields #

Name	Description
`TaskName` UnicodeString
`TaskEngineName` UnicodeString
`TaskInstanceId` GUID

Event ID 305: Task Scheduler did not send "TaskName" task to Task Engine "TaskEngineName" .

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Taskfailedtobesenttoengine
Opcode: Failure

Description

Task Scheduler did not send "TaskName" task to Task Engine "TaskEngineName" . Additional Data: Error Value: ResultCode.

Message #

Task Scheduler did not send "%1"  task to Task Engine "%2" . Additional Data: Error Value: %3.

Fields #

Name	Description
`TaskName` UnicodeString
`TaskEngineName` UnicodeString
`ResultCode` UInt32

Event ID 306: For Task Scheduler Task Engine "TaskEngineName" , the thread pool failed to process the message.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Enginefailedtoreceivethetask
Opcode: Failure

Description

For Task Scheduler Task Engine "TaskEngineName" , the thread pool failed to process the message. Additional Data: Error Value: ResultCode.

Message #

For Task Scheduler Task Engine "%1" , the thread pool failed to process the message. Additional Data: Error Value: %2.

Fields #

Name	Description
`TaskEngineName` UnicodeString
`ResultCode` UInt32

Event ID 307: Task Scheduler service failed to connect to the Task Engine "TaskEngineName" process.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: ServiceEngineconnectionfailure
Opcode: Failure

Description

Task Scheduler service failed to connect to the Task Engine "TaskEngineName" process. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler service failed to connect to the Task Engine "%1"  process. Additional Data: Error Value: %2.

Fields #

Name	Description
`TaskEngineName` UnicodeString
`ResultCode` UInt32

Event ID 308: Task Scheduler connected to the Task Engine "TaskEngineName" process.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: ServiceEngineconnected

Description

Task Scheduler connected to the Task Engine "TaskEngineName" process.

Message #

Task Scheduler connected to the Task Engine "%1"  process.

Fields #

Name	Description
`TaskEngineName` UnicodeString

Event ID 309: Task Scheduler TaskCount tasks orphaned during Task Engine "TaskEngineName" shutdown.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Engineorphaned

Description

Task Scheduler TaskCount tasks orphaned during Task Engine "TaskEngineName" shutdown. User Action: Find the process run by this task in the Task Manager and kill it manually.

Message #

Task Scheduler %1 tasks orphaned during Task Engine "%2"  shutdown. User Action: Find the process run by this task in the Task Manager and kill it manually.

Fields #

Name	Description
`TaskCount` UInt32
`TaskEngineName` UnicodeString

Event ID 310: Task Scheduler started Task Engine "TaskEngineName" process.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: TaskEnginestarted

Description

Task Scheduler started Task Engine "TaskEngineName" process. Command="Command" , ProcessID=ProcessID, ThreadID=ThreadID.

Message #

Task Scheduler started Task Engine "%1"  process. Command="%2" , ProcessID=%3, ThreadID=%4

Fields #

Name	Description
`TaskEngineName` UnicodeString
`Command` UnicodeString
`ProcessID` UInt32
`ThreadID` UInt32

Event ID 311: Task Scheduler failed to start Task Engine "TaskEngineName" process due to an error occurring in "ErrorDescription" .

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: TaskEnginefailedtostart
Opcode: LaunchFailure

Description

Task Scheduler failed to start Task Engine "TaskEngineName" process due to an error occurring in "ErrorDescription" . Command="Command" . Additional Data: Error Value: ResultCode.

Message #

Task Scheduler failed to start Task Engine "%1"  process due to an error occurring in "%3" . Command="%2" . Additional Data: Error Value: %4.

Fields #

Name	Description
`TaskEngineName` UnicodeString
`Command` UnicodeString
`ErrorDescription` UnicodeString
`ResultCode` UInt32

Event ID 312: Task Scheduler created the Win32 job object for Task Engine "TaskEngineName" .

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: TaskEnginejobobjectcreated

Description

Task Scheduler created the Win32 job object for Task Engine "TaskEngineName" .

Message #

Task Scheduler created the Win32 job object for Task Engine "%1" .

Fields #

Name	Description
`TaskEngineName` UnicodeString

Event ID 313: Task Scheduler channel with Task Engine "TaskEngineName" is ready to send and receive messages.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: ServiceEnginechannelready

Description

Task Scheduler channel with Task Engine "TaskEngineName" is ready to send and receive messages.

Message #

Task Scheduler channel with Task Engine "%1"  is ready to send and receive messages.

Fields #

Name	Description
`TaskEngineName` UnicodeString

Event ID 314: Task Scheduler has no tasks running for Task Engine "TaskEngineName" , and the idle timer has started.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: TaskEngineidle

Description

Task Scheduler has no tasks running for Task Engine "TaskEngineName" , and the idle timer has started.

Message #

Task Scheduler has no tasks running for Task Engine "%1" , and the idle timer has started.

Fields #

Name	Description
`TaskEngineName` UnicodeString

Event ID 315: Task Engine "TaskEngineName" process failed to connect to the Task Scheduler service.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: ServiceEngineconnectionfailure_315
Opcode: Failure

Description

Task Engine "TaskEngineName" process failed to connect to the Task Scheduler service. Additional Data: Error Value: ResultCode.

Message #

Task Engine "%1"  process failed to connect to the Task Scheduler service. Additional Data: Error Value: %2.

Fields #

Name	Description
`TaskEngineName` UnicodeString
`ResultCode` UInt32

Event ID 316: Task Engine "TaskEngineName" failed to send a message to the Task Scheduler service.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Enginefailedtosendmessagetoservice
Opcode: Failure

Description

Task Engine "TaskEngineName" failed to send a message to the Task Scheduler service. Additional Data: Error Value: ResultCode.

Message #

Task Engine "%1"  failed to send a message to the Task Scheduler service. Additional Data: Error Value: %2.

Fields #

Name	Description
`TaskEngineName` UnicodeString
`ResultCode` UInt32

Event ID 317: Task Scheduler started Task Engine "TaskEngineName" process.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: TaskEnginestarted_317
Opcode: Start

Description

Task Scheduler started Task Engine "TaskEngineName" process.

Message #

Task Scheduler started Task Engine "%1"  process.

Fields #

Name	Description
`TaskEngineName` UnicodeString

Event ID 318: Task Scheduler shutdown Task Engine "TaskEngineName" process.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Taskengineproperlyshutdown_318
Opcode: Stop

Description

Task Scheduler shutdown Task Engine "TaskEngineName" process.

Message #

Task Scheduler shutdown Task Engine "%1"  process.

Fields #

Name	Description
`TaskEngineName` UnicodeString

Event ID 319: Task Engine "TaskEngineName" received a message from Task Scheduler service requesting to launch task "TaskName" .

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: TaskEnginereceivedmessagetostarttask
Opcode: Start

Description

Task Engine "TaskEngineName" received a message from Task Scheduler service requesting to launch task "TaskName" .

Message #

Task Engine "%1"  received a message from Task Scheduler service requesting to launch task "%2" .

Fields #

Name	Description
`TaskEngineName` UnicodeString
`TaskName` UnicodeString

Event ID 320: Task Engine "TaskEngineName" received a message from Task Scheduler service requesting to stop task instance "TaskInstanceId" .

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: TaskEnginereceivedmessagetostoptask
Opcode: Stop

Description

Task Engine "TaskEngineName" received a message from Task Scheduler service requesting to stop task instance "TaskInstanceId" .

Message #

Task Engine "%1"  received a message from Task Scheduler service requesting to stop task instance "%2" .

Fields #

Name	Description
`TaskEngineName` UnicodeString
`TaskInstanceId` GUID

Event ID 322: Task Scheduler did not launch task "Name" because instance "TaskName" of the same task is already running.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Level: Warning
Collection Priority: Recommended (Yamato Security)
Task: Launchrequestignored,instancealreadyrunning

Description

Task Scheduler did not launch task "Name" because instance "TaskName" of the same task is already running.

Message #

Task Scheduler did not launch task "%1"  because instance "%2"  of the same task is already running.

Fields #

Name	Description
`TaskName` UnicodeString
`TaskInstanceId` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}",
    "event_source_name": "",
    "event_id": 322,
    "version": 0,
    "level": 3,
    "task": 322,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T14:11:36.9378051+00:00",
    "event_record_id": 8903,
    "correlation": {
      "ActivityID": "{1BECE11B-517E-4ED5-80AD-D07D523F886F}"
    },
    "execution": {
      "process_id": 2100,
      "thread_id": 6220
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "TaskName": "\\Microsoft\\Windows\\Input\\LocalUserSyncDataAvailable",
    "TaskInstanceId": "{1bece11b-517e-4ed5-80ad-d07d523f886f}"
  },
  "message": "Task Scheduler did not launch task \"\\Microsoft\\Windows\\Input\\LocalUserSyncDataAvailable\"  because instance \"{1bece11b-517e-4ed5-80ad-d07d523f886f}\"  of the same task is already running."
}

Event ID 323: Task Scheduler stopped instance "StoppedTaskInstanceId" of task "TaskName" in order to launch new instance "NewTaskInstanceId" .

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Launchrequestacknowledged,currentinstancestopped

Description

Task Scheduler stopped instance "StoppedTaskInstanceId" of task "TaskName" in order to launch new instance "NewTaskInstanceId" .

Message #

Task Scheduler stopped instance "%2"  of task "%1"  in order to launch new instance "%3" .

Fields #

Name	Description
`TaskName` UnicodeString
`StoppedTaskInstanceId` GUID
`NewTaskInstanceId` GUID

Event ID 324: Task Scheduler queued instance "TaskName" of task "Name" and will launch it as soon as instance "QueuedTaskInstanceId" completes.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Level: Warning
Collection Priority: Recommended (Yamato Security)
Task: Launchrequestqueued,instancealreadyrunning

Description

Task Scheduler queued instance "TaskName" of task "Name" and will launch it as soon as instance "QueuedTaskInstanceId" completes.

Message #

Task Scheduler queued instance "%2"  of task "%1"  and will launch it as soon as instance "%3"  completes.

Fields #

Name	Description
`TaskName` UnicodeString
`QueuedTaskInstanceId` GUID
`RunningTaskInstanceId` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}",
    "event_source_name": "",
    "event_id": 324,
    "version": 0,
    "level": 3,
    "task": 324,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-29T08:36:45.2235251+00:00",
    "event_record_id": 11252,
    "correlation": {
      "ActivityID": "{4D83D61D-8031-40E8-B178-CEFD3C1682A7}"
    },
    "execution": {
      "process_id": 1608,
      "thread_id": 728
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "telemetry-DC-b.cell-b.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "TaskName": "\\Microsoft\\Windows\\Windows Error Reporting\\QueueReporting",
    "QueuedTaskInstanceId": "{4d83d61d-8031-40e8-b178-cefd3c1682a7}",
    "RunningTaskInstanceId": "{ea30723f-4a36-4ca9-aa48-a8b23cfc4dcb}"
  },
  "message": "Task Scheduler queued instance \"{4d83d61d-8031-40e8-b178-cefd3c1682a7}\"  of task \"\\Microsoft\\Windows\\Windows Error Reporting\\QueueReporting\"  and will launch it as soon as instance \"{ea30723f-4a36-4ca9-aa48-a8b23cfc4dcb}\"  completes."
}

Event ID 325: Task Scheduler queued instance "TaskName" of task "Name".

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Level: Warning
Collection Priority: Recommended (Yamato Security)
Task: Launchrequestqueued

Description

Task Scheduler queued instance "TaskName" of task "Name".

Message #

Task Scheduler queued instance "%2"  of task "%1".

Fields #

Name	Description
`TaskName` UnicodeString
`QueuedTaskInstanceId` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}",
    "event_source_name": "",
    "event_id": 325,
    "version": 0,
    "level": 3,
    "task": 325,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T06:04:36.7624198+00:00",
    "event_record_id": 7755,
    "correlation": {
      "ActivityID": "{0F4AC548-8C6F-4BFB-A090-4BB457F739FE}"
    },
    "execution": {
      "process_id": 2100,
      "thread_id": 5196
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "TaskName": "\\Microsoft\\Windows\\Power Efficiency Diagnostics\\AnalyzeSystem",
    "QueuedTaskInstanceId": "{0f4ac548-8c6f-4bfb-a090-4bb457f739fe}"
  },
  "message": "Task Scheduler queued instance \"{0f4ac548-8c6f-4bfb-a090-4bb457f739fe}\"  of task \"\\Microsoft\\Windows\\Power Efficiency Diagnostics\\AnalyzeSystem\"."
}

Event ID 326: Task Scheduler did not launch task "TaskName" because computer is running on batteries.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Launchconditionnotmet,computeronbatteries

Description

Task Scheduler did not launch task "TaskName" because computer is running on batteries. User Action: If launching the task on batteries is required, change the respective flag in the task configuration.

Message #

Task Scheduler did not launch task "%1"  because computer is running on batteries. User Action: If launching the task on batteries is required, change the respective flag in the task configuration.

Fields #

Name	Description
`TaskName` UnicodeString

Event ID 327: Task Scheduler stopped instance "TaskInstanceId" of task "TaskName" because the computer is switching to battery power.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Taskstoppingduetoswitchingtobatteries

Description

Task Scheduler stopped instance "TaskInstanceId" of task "TaskName" because the computer is switching to battery power.

Message #

Task Scheduler stopped instance "%2"  of task "%1"  because the computer is switching to battery power.

Fields #

Name	Description
`TaskName` UnicodeString
`TaskInstanceId` GUID

Event ID 328: Task Scheduler stopped instance "TaskName" of task "Name" because computer is no longer idle.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Level: Informational
Collection Priority: Recommended (Yamato Security)
Task: Taskstoppingduetocomputernotidle

Description

Task Scheduler stopped instance "TaskName" of task "Name" because computer is no longer idle.

Message #

Task Scheduler stopped instance "%2"  of task "%1"  because computer is no longer idle.

Fields #

Name	Description
`TaskName` UnicodeString
`TaskInstanceId` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 328,
    "version": 0,
    "level": 4,
    "task": 328,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-09T00:55:21.200143+00:00",
    "event_record_id": 31697,
    "correlation": {
      "ActivityID": "1D9CAE68-87E2-4B98-9413-7A44D523E01F"
    },
    "execution": {
      "process_id": 1972,
      "thread_id": 1088
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "StoppingOnIdleEnd",
    "TaskName": "\\Microsoft\\Windows\\MemoryDiagnostic\\RunFullMemoryDiagnostic",
    "TaskInstanceId": "1D9CAE68-87E2-4B98-9413-7A44D523E01F"
  },
  "message": ""
}

Event ID 329: Task Scheduler terminated "TaskName" instance of the "Name" task due to exceeding the time allocated for execution, as configured in the task definition.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Level: Informational
Collection Priority: Recommended (Yamato Security)
Task: Taskstoppingduetotimeoutreached

Description

Task Scheduler terminated "TaskInstanceId" instance of the "TaskName" task due to exceeding the time allocated for execution, as configured in the task definition. User Action: Increase the configured task timeout or investigate external reasons for the delay.

Message #

Task Scheduler terminated "%2"  instance of the "%1"  task due to exceeding the time allocated for execution, as configured in the task definition. User Action: Increase the configured task timeout or investigate external reasons for the delay.

Fields #

Name	Description
`TaskName` UnicodeString
`TaskInstanceId` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}",
    "event_source_name": "",
    "event_id": 329,
    "version": 0,
    "level": 4,
    "task": 329,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-28T11:14:38.1504371+00:00",
    "event_record_id": 497,
    "correlation": {
      "ActivityID": "{917B25A3-2CF9-4FD1-9CB2-7DB19852FF8A}"
    },
    "execution": {
      "process_id": 1756,
      "thread_id": 2876
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "TaskName": "\\Microsoft\\Windows\\Shell\\CreateObjectTask",
    "TaskInstanceId": "{917b25a3-2cf9-4fd1-9cb2-7db19852ff8a}"
  },
  "message": "Task Scheduler terminated \"{917b25a3-2cf9-4fd1-9cb2-7db19852ff8a}\"  instance of the \"\\Microsoft\\Windows\\Shell\\CreateObjectTask\"  task due to exceeding the time allocated for execution, as configured in the task definition. User Action: Increase the configured task timeout or investigate external reasons for the delay."
}

Event ID 330: Task Scheduler stopped instance "TaskName" of task "Name" as request by user "TaskInstanceId" .

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Level: Informational
Collection Priority: Recommended (Yamato Security)
Task: Taskstoppingduetouserrequest

Description

Task Scheduler stopped instance "TaskName" of task "Name" as request by user "TaskInstanceId" .

Message #

Task Scheduler stopped instance "%2"  of task "%1"  as request by user "%3" .

Fields #

Name	Description
`TaskName` UnicodeString
`TaskInstanceId` GUID
`UserContext` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}",
    "event_source_name": "",
    "event_id": 330,
    "version": 0,
    "level": 4,
    "task": 330,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-29T08:44:12.4364330+00:00",
    "event_record_id": 6324,
    "correlation": {
      "ActivityID": "{9B5A34F6-ABB2-4FCC-83E4-4589AFF754C1}"
    },
    "execution": {
      "process_id": 2072,
      "thread_id": 5376
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "TaskName": "\\Microsoft\\Windows\\Windows Defender\\Windows Defender Scheduled Scan",
    "TaskInstanceId": "{9b5a34f6-abb2-4fcc-83e4-4589aff754c1}",
    "UserContext": "NT AUTHORITY\\SYSTEM"
  },
  "message": "Task Scheduler stopped instance \"{9b5a34f6-abb2-4fcc-83e4-4589aff754c1}\"  of task \"\\Microsoft\\Windows\\Windows Defender\\Windows Defender Scheduled Scan\"  as request by user \"NT AUTHORITY\\SYSTEM\" ."
}

Event ID 331: Task Scheduler will continue to execute Instance "TaskInstanceId" of task "TaskName" even after the designated timeout, due to a failure to create the timeout mechan...

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Taskfailedtostopontimeout

Description

Task Scheduler will continue to execute Instance "TaskInstanceId" of task "TaskName" even after the designated timeout, due to a failure to create the timeout mechanism. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler will continue to execute Instance "%2"  of task "%1"  even after the designated timeout, due to a failure to create the timeout mechanism. Additional Data: Error Value: %3.

Fields #

Name	Description
`TaskName` UnicodeString
`TaskInstanceId` GUID
`ResultCode` UInt32

Event ID 332: Task Scheduler did not launch task "Name" because user "TaskName" was not logged on when the launching conditions were met.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Level: Warning
Collection Priority: Recommended (Yamato Security)
Task: Launchconditionnotmet,usernotlogged_on

Description

Task Scheduler did not launch task "TaskName" because user "UserName" was not logged on when the launching conditions were met. User Action: Ensure user is logged on or change the task definition to allow launching when user is logged off.

Message #

Task Scheduler did not launch task "%1"  because user "%2" was not logged on when the launching conditions were met. User Action: Ensure user is logged on or change the task definition to allow launching when user is logged off.

Fields #

Name	Description
`TaskName` UnicodeString
`UserName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 332,
    "version": 0,
    "level": 3,
    "task": 332,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T01:13:11.824978+00:00",
    "event_record_id": 956,
    "correlation": {},
    "execution": {
      "process_id": 1392,
      "thread_id": 14508
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "NoStartUserNotLogged",
    "TaskName": "\\Microsoft\\VisualStudio\\Updates\\BackgroundDownload",
    "UserName": "WINDEV2310EVAL\\Administrator"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 333: Task Scheduler did not launch task "TaskName" because target session is RemoteApp session.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Launchconditionnotmet,sessionisRemoteAppSession

Description

Task Scheduler did not launch task "TaskName" because target session is RemoteApp session. User Action: If launching the task on RemoteApp sessions is required, change the respective flag in the task configuration.

Message #

Task Scheduler did not launch task "%1"  because target session is RemoteApp session. User Action: If launching the task on RemoteApp sessions is required, change the respective flag in the task configuration.

Fields #

Name	Description
`TaskName` UnicodeString

Event ID 334: Task Scheduler did not launch task "TaskName" because target session is a WORKER session.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Launchconditionnotmet,sessionisaWorkerSession

Description

Task Scheduler did not launch task "TaskName" because target session is a WORKER session.

Message #

Task Scheduler did not launch task "%1"  because target session is a WORKER session.

Fields #

Name	Description
`TaskName` UnicodeString

Event ID 400: Task Scheduler service has started.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Level: Informational
Collection Priority: Recommended (Yamato Security)
Task: Servicestarted
Opcode: Start

Description

Task Scheduler service has started.

Message #

Task Scheduler service has started.

Fields #

Name	Description
`Name`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}",
    "event_source_name": "",
    "event_id": 400,
    "version": 0,
    "level": 4,
    "task": 400,
    "opcode": 1,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-29T16:32:54.2209119+00:00",
    "event_record_id": 6743,
    "correlation": {},
    "execution": {
      "process_id": 2100,
      "thread_id": 2324
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "Task Scheduler service has started."
}

Event ID 401: Task Scheduler service failed to start due to an error in "ErrorDescription" .

Provider: Microsoft-Windows-TaskScheduler
Channel: System
Task: Servicefailedtostart
Opcode: LaunchFailure

Description

Task Scheduler service failed to start due to an error in "ErrorDescription" . Additional Data: Error Value: ResultCode.

Message #

Task Scheduler service failed to start due to an error in "%1" . Additional Data: Error Value: %2.

Fields #

Name	Description
`ErrorDescription` UnicodeString
`ResultCode` UInt32

Event ID 402: Task Scheduler service is shutting down.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Level: Informational
Collection Priority: Recommended (Yamato Security)
Task: Serviceisshuttingdown
Opcode: Stop

Description

Task Scheduler service is shutting down.

Message #

Task Scheduler service is shutting down.

Fields #

Name	Description
`Name`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}",
    "event_source_name": "",
    "event_id": 402,
    "version": 0,
    "level": 4,
    "task": 402,
    "opcode": 2,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T05:22:34.5284921+00:00",
    "event_record_id": 14560,
    "correlation": {},
    "execution": {
      "process_id": 1680,
      "thread_id": 2100
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "Task Scheduler service is shutting down."
}

Event ID 403: Task Scheduler service has encountered an error in "ErrorDescription" .

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Servicecriticalerror
Opcode: Failure

Description

Task Scheduler service has encountered an error in "ErrorDescription" . Additional Data: Error Value: ResultCode.

Message #

Task Scheduler service has encountered an error in "%1" . Additional Data: Error Value: %2.

Fields #

Name	Description
`ErrorDescription` UnicodeString
`ResultCode` UInt32

Event ID 404: Task Scheduler service has encountered RPC initialization error in "ErrorDescription".

Provider: Microsoft-Windows-TaskScheduler
Channel: System
Task: ServiceRPCerror

Description

Task Scheduler service has encountered RPC initialization error in "ErrorDescription". Additional Data: Error Value: ResultCode.

Message #

Task Scheduler service has encountered RPC initialization error in "%1". Additional Data: Error Value: %2.

Fields #

Name	Description
`ErrorDescription` UnicodeString
`ResultCode` UInt32

Event ID 405: Task Scheduler service has failed to initialize COM.

Provider: Microsoft-Windows-TaskScheduler
Channel: System
Task: ServiceCOMerror

Description

Task Scheduler service has failed to initialize COM. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler service has failed to initialize COM. Additional Data: Error Value: %1.

Fields #

Name	Description
`ResultCode` UInt32

Event ID 406: Task Scheduler service failed to initialize credentials store.

Provider: Microsoft-Windows-TaskScheduler
Channel: System
Task: Credstoreinitializationerror

Description

Task Scheduler service failed to initialize credentials store. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler service failed to initialize credentials store. Additional Data: Error Value: %1.

Fields #

Name	Description
`ResultCode` UInt32

Event ID 407: Task Scheduler service failed to initialize LSA.

Provider: Microsoft-Windows-TaskScheduler
Channel: System
Task: LSAinitializationerror

Description

Task Scheduler service failed to initialize LSA. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler service failed to initialize LSA. Additional Data: Error Value: %1.

Fields #

Name	Description
`ResultCode` UInt32

Event ID 408: Task Scheduler service failed to initialize idle state detection module.

Provider: Microsoft-Windows-TaskScheduler
Channel: System
Task: Idledetectionerror

Description

Task Scheduler service failed to initialize idle state detection module. Idle tasks may not be started as required. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler service failed to initialize idle state detection module. Idle tasks may not be started as required. Additional Data: Error Value: %1.

Fields #

Name	Description
`ResultCode` UInt32

Event ID 409: Task Scheduler service failed to initialize time change notification.

Provider: Microsoft-Windows-TaskScheduler
Channel: System
Task: Timechangenotificationerror

Description

Task Scheduler service failed to initialize time change notification. System time updates may not be picked by the service and task schedules may not be updated. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler service failed to initialize time change notification. System time updates may not be picked by the service and task schedules may not be updated. Additional Data: Error Value: %1.

Fields #

Name	Description
`ResultCode` UInt32

Event ID 410: Task Scheduler service failed to set a wakeup timer.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Wakeuptimererror

Description

Task Scheduler service failed to set a wakeup timer. As a result, some scheduled tasks may not run while the system is suspended. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler service failed to set a wakeup timer. As a result, some scheduled tasks may not run while the system is suspended. Additional Data: Error Value: %1.

Fields #

Name	Description
`ResultCode` UInt32

Event ID 411: Task Scheduler service received a time system change notification.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Level: Informational
Collection Priority: Recommended (Yamato Security)
Task: Servicesignaledtimechange

Description

Task Scheduler service received a time system change notification.

Message #

Task Scheduler service received a time system change notification.

Fields #

Name	Description
`Name`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 411,
    "version": 0,
    "level": 4,
    "task": 411,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-08T23:13:40.513605+00:00",
    "event_record_id": 30045,
    "correlation": {},
    "execution": {
      "process_id": 2316,
      "thread_id": 2468
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "TimeChangeSignaled"
  },
  "message": ""
}

Event ID 412: Task Scheduler service failed to launch tasks triggered by computer startup.

Provider: Microsoft-Windows-TaskScheduler
Channel: System
Task: Servicecriticalerror

Description

Task Scheduler service failed to launch tasks triggered by computer startup. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler service failed to launch tasks triggered by computer startup. Additional Data: Error Value: %1.

Fields #

Name	Description
`ResultCode` UInt32

Event ID 413: Task Scheduler service failed to load tasks at service startup.

Provider: Microsoft-Windows-TaskScheduler
Channel: System
Task: Servicecriticalerror

Description

Task Scheduler service failed to load tasks at service startup. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler service failed to load tasks at service startup. Additional Data: Error Value: %1.

Fields #

Name	Description
`ResultCode` UInt32

Event ID 414: Task Scheduler service found a misconfiguration in the TaskName definition.

Provider: Microsoft-Windows-TaskScheduler
Channel: System
Task: TaskMisconfiguration

Description

Task Scheduler service found a misconfiguration in the TaskName definition. Additional Data: Error Value: Parameter.

Message #

Task Scheduler service found a misconfiguration in the %1 definition. Additional Data: Error Value: %2.

Fields #

Name	Description
`TaskName` UnicodeString
`Parameter` UnicodeString

Event ID 500: Process ID ProcessId has registered idle task ID IdleTaskId.

Provider: Microsoft-Windows-TaskScheduler
Channel: Diagnostic
Task: IdleTaskRegister

Description

Process ID ProcessId has registered idle task ID IdleTaskId.

Message #

Process ID %2 has registered idle task ID %1.

Fields #

Name	Description
`IdleTaskId` UInt32
`ProcessId` UInt32

Event ID 501: Process ID ProcessId has completed idle task ID IdleTaskId.

Provider: Microsoft-Windows-TaskScheduler
Channel: Diagnostic
Task: IdleTaskUnregister

Description

Process ID ProcessId has completed idle task ID IdleTaskId.

Message #

Process ID %2 has completed idle task ID %1.

Fields #

Name	Description
`IdleTaskId` UInt32
`ProcessId` UInt32

Event ID 502: Execution of idle task ID IdleTaskId has started.

Provider: Microsoft-Windows-TaskScheduler
Channel: Diagnostic
Task: IdleTaskExecute
Opcode: Start

Description

Execution of idle task ID IdleTaskId has started.

Message #

Execution of idle task ID %1 has started.

Fields #

Name	Description
`IdleTaskId` UInt32
`ProcessId` UInt32

Event ID 503: Execution of idle task ID IdleTaskId has ended.

Provider: Microsoft-Windows-TaskScheduler
Channel: Diagnostic
Task: IdleTaskExecute
Opcode: Stop

Description

Execution of idle task ID IdleTaskId has ended.

Message #

Execution of idle task ID %1 has ended.

Fields #

Name	Description
`IdleTaskId` UInt32
`ProcessId` UInt32

Event ID 504: Idle task ID IdleTaskId has been notified that explicit processing has been requested.

Provider: Microsoft-Windows-TaskScheduler
Channel: Diagnostic
Task: IdleTaskNotify
Opcode: Start

Description

Idle task ID IdleTaskId has been notified that explicit processing has been requested.

Message #

Idle task ID %1 has been notified that explicit processing has been requested.

Fields #

Name	Description
`IdleTaskId` UInt32
`ProcessId` UInt32

Event ID 505: Idle task ID IdleTaskId has returned from its explicit processing notification.

Provider: Microsoft-Windows-TaskScheduler
Channel: Diagnostic
Task: IdleTaskNotify
Opcode: Stop

Description

Idle task ID IdleTaskId has returned from its explicit processing notification.

Message #

Idle task ID %1 has returned from its explicit processing notification.

Fields #

Name	Description
`IdleTaskId` UInt32
`ProcessId` UInt32

Event ID 506: Explicit execution of all idle tasks has been requested.

Provider: Microsoft-Windows-TaskScheduler
Channel: Diagnostic
Task: IdleTaskExplicitProcessing
Opcode: Start

Description

Explicit execution of all idle tasks has been requested.

Message #

Explicit execution of all idle tasks has been requested.

Event ID 507: Explicit execution of all idle tasks has completed.

Provider: Microsoft-Windows-TaskScheduler
Channel: Diagnostic
Task: IdleTaskExplicitProcessing
Opcode: Stop

Description

Explicit execution of all idle tasks has completed.

Message #

Explicit execution of all idle tasks has completed.

Event ID 508: Explicit execution of all idle tasks is in progress.

Provider: Microsoft-Windows-TaskScheduler
Channel: Diagnostic
Task: IdleTaskExplicitProcessingActive

Description

Explicit execution of all idle tasks is in progress.

Message #

Explicit execution of all idle tasks is in progress.

Event ID 509: Idle Task Power Notification Received: NotificationType (State).

Provider: Microsoft-Windows-TaskScheduler
Channel: Diagnostic
Task: IdleTaskPowerNotificationReceived

Description

Idle Task Power Notification Received: NotificationType (State).

Message #

Idle Task Power Notification Received: %1 (%2)

Fields #

Name	Description
`NotificationType` UnicodeString
`State` UInt32

Event ID 510: Idle Task PerfTrack Resource Consumption

Provider: Microsoft-Windows-TaskScheduler
Channel: Diagnostic
Task: IdleTaskPerfTrackResourceConsumption

Fields #

Name	Description
`NoIdleReason` UInt32
`DATA1` UInt32
`DATA2` UInt32

Event ID 511: Idle Task PerfTrack Idle Exit

Provider: Microsoft-Windows-TaskScheduler
Channel: Diagnostic
Task: IdleTaskPerfTrackIdleExit

Fields #

Name	Description
`TimeSinceUserNotPresent` UInt32
`DATA` UInt32

Event ID 512: Idle check point: State DetectionResult, Reason Reason.

Provider: Microsoft-Windows-TaskScheduler
Channel: Diagnostic
Task: IdleCheckPoint

Description

Idle check point: State DetectionResult, Reason Reason.

Message #

Idle check point: State %1, Reason %2.

Fields #

Name	Description
`DetectionResult` UInt32
`Reason` UInt32

Event ID 700: Task Scheduler service started Task Compatibility module.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Level: Informational
Collection Priority: Recommended (Yamato Security)
Task: Compatibilitymodulestarted

Description

Task Scheduler service started Task Compatibility module.

Message #

Task Scheduler service started Task Compatibility module.

Fields #

Name	Description
`Name`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}",
    "event_source_name": "",
    "event_id": 700,
    "version": 0,
    "level": 4,
    "task": 700,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-29T16:32:54.1752737+00:00",
    "event_record_id": 6742,
    "correlation": {},
    "execution": {
      "process_id": 2100,
      "thread_id": 2324
    },
    "channel": "Microsoft-Windows-TaskScheduler/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "Task Scheduler service started Task Compatibility module."
}

Event ID 701: Task Scheduler service failed to start Task Compatibility module.

Provider: Microsoft-Windows-TaskScheduler
Channel: System
Task: Compatibilitymodulefailedtostart

Description

Task Scheduler service failed to start Task Compatibility module. Tasks may not be able to register on previous Window versions. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler service failed to start Task Compatibility module. Tasks may not be able to register on previous Window versions. Additional Data: Error Value: %1.

Fields #

Name	Description
`ResultCode` UInt32

Event ID 702: Task Scheduler failed to initialize the RPC server for starting the Task Compatibility module.

Provider: Microsoft-Windows-TaskScheduler
Channel: System
Task: CompatibilitymoduleRPCfailed

Description

Task Scheduler failed to initialize the RPC server for starting the Task Compatibility module. Tasks may not be able to register on previous Window versions. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler failed to initialize the RPC server for starting the Task Compatibility module. Tasks may not be able to register on previous Window versions. Additional Data: Error Value: %1.

Fields #

Name	Description
`ResultCode` UInt32

Event ID 703: Task Scheduler failed to initialize Net Schedule API for starting the Task Compatibility module.

Provider: Microsoft-Windows-TaskScheduler
Channel: System
Task: CompatibilitymoduleNetScheduleAPIfailed

Description

Task Scheduler failed to initialize Net Schedule API for starting the Task Compatibility module. Tasks may not be able to register on previous Window versions. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler failed to initialize Net Schedule API for starting the Task Compatibility module. Tasks may not be able to register on previous Window versions. Additional Data: Error Value: %1.

Fields #

Name	Description
`ResultCode` UInt32

Event ID 704: Task Scheduler failed to initialize LSA for starting the Task Compatibility module.

Provider: Microsoft-Windows-TaskScheduler
Channel: System
Task: CompatibilitymoduleLSAfailed

Description

Task Scheduler failed to initialize LSA for starting the Task Compatibility module. Tasks may not be able to register on previous Window versions. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler failed to initialize LSA for starting the Task Compatibility module. Tasks may not be able to register on previous Window versions. Additional Data: Error Value: %1.

Fields #

Name	Description
`ResultCode` UInt32

Event ID 705: Task Scheduler failed to start directory monitoring for the Task Compatibility module.

Provider: Microsoft-Windows-TaskScheduler
Channel: System
Task: Compatibilitymoduledirectorymonitoringfailed

Description

Task Scheduler failed to start directory monitoring for the Task Compatibility module. Additional Data: Error Value: ResultCode.

Message #

Task Scheduler failed to start directory monitoring for the Task Compatibility module. Additional Data: Error Value: %1.

Fields #

Name	Description
`ResultCode` UInt32

Event ID 706: Task Compatibility module failed to update task "TaskName" to the required status TaskStatus.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Compatibilitymoduletaskstatusupdatefailed

Description

Task Compatibility module failed to update task "TaskName" to the required status TaskStatus. Additional Data: Error Value: ResultCode.

Message #

Task Compatibility module failed to update task "%1"  to the required status %2. Additional Data: Error Value: %3.

Fields #

Name	Description
`TaskName` UnicodeString
`TaskStatus` UInt32
`ResultCode` UInt32

Event ID 707: Task Compatibility module failed to delete task "TaskName" .

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Compatibilitymoduletaskdeletionfailed

Description

Task Compatibility module failed to delete task "TaskName" . Additional Data: Error Value: ResultCode.

Message #

Task Compatibility module failed to delete task "%1" . Additional Data: Error Value: %2.

Fields #

Name	Description
`TaskName` UnicodeString
`ResultCode` UInt32

Event ID 708: Task Compatibility module failed to set security descriptor "SecurityDescriptor" for task "TaskName" .

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Compatibilitymodulesecuritydescriptorfailed

Description

Task Compatibility module failed to set security descriptor "SecurityDescriptor" for task "TaskName" . Additional Data: Error Value: ResultCode.

Message #

Task Compatibility module failed to set security descriptor "%1"  for task "%2" . Additional Data: Error Value: %3.

Fields #

Name	Description
`SecurityDescriptor` UnicodeString
`TaskName` UnicodeString
`ResultCode` UInt32

Event ID 709: Task Compatibility module failed to update task "TaskName" .

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Compatibilitymoduletaskupdatefailed

Description

Task Compatibility module failed to update task "TaskName" . Additional Data: Error Value: ResultCode.

Message #

Task Compatibility module failed to update task "%1" . Additional Data: Error Value: %2.

Fields #

Name	Description
`TaskName` UnicodeString
`ResultCode` UInt32

Event ID 710: Task Compatibility module failed to upgrade existing tasks.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Compatibilitymoduletasksupgradefailed

Description

Task Compatibility module failed to upgrade existing tasks. Upgrade will be attempted again next time 'Task Scheduler' service starts. Additional Data: Error Value: ResultCode.

Message #

Task Compatibility module failed to upgrade existing tasks. Upgrade will be attempted again next time 'Task Scheduler' service starts. Additional Data: Error Value: %1.

Fields #

Name	Description
`ResultCode` UInt32

Event ID 711: Task Compatibility module failed to upgrade NetSchedule account "Account" .

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Compatibilitymoduletasksupgradefailed

Description

Task Compatibility module failed to upgrade NetSchedule account "Account" . Additional Data: Error Value: ResultCode.

Message #

Task Compatibility module failed to upgrade NetSchedule account "%1" . Additional Data: Error Value: %2.

Fields #

Name	Description
`Account` UnicodeString
`ResultCode` UInt32

Event ID 712: Task Compatibility module failed to read existing store to upgrade tasks.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Compatibilitymoduletasksupgradefailed

Description

Task Compatibility module failed to read existing store to upgrade tasks. Additional Data: Error Value: ResultCode.

Message #

Task Compatibility module failed to read  existing store to upgrade tasks. Additional Data: Error Value: %1.

Fields #

Name	Description
`ResultCode` UInt32

Event ID 713: Task Compatibility module failed to load task "TaskName" for upgrade.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Compatibilitymoduletasksupgradefailed

Description

Task Compatibility module failed to load task "TaskName" for upgrade. Additional Data: Error Value: ResultCode.

Message #

Task Compatibility module failed to load task  "%1" for upgrade. Additional Data: Error Value: %2.

Fields #

Name	Description
`TaskName` UnicodeString
`ResultCode` UInt32

Event ID 714: Task Compatibility module failed to register task "TaskName" for upgrade.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Compatibilitymoduletasksupgradefailed

Description

Task Compatibility module failed to register task "TaskName" for upgrade. Additional Data: Error Value: ResultCode.

Message #

Task Compatibility module failed to register  task  "%1" for upgrade. Additional Data: Error Value: %2.

Fields #

Name	Description
`TaskName` UnicodeString
`ResultCode` UInt32

Event ID 715: Task Compatibility module failed to delete LSA store for upgrade.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Compatibilitymoduletasksupgradefailed

Description

Task Compatibility module failed to delete LSA store for upgrade. Additional Data: Error Value: ResultCode.

Message #

Task Compatibility module failed to delete  LSA store for upgrade. Additional Data: Error Value: %1.

Fields #

Name	Description
`ResultCode` UInt32

Event ID 716: Task Compatibility module failed to upgrade existing scheduled tasks.

Provider: Microsoft-Windows-TaskScheduler
Channel: System
Task: Compatibilitymoduletasksupgradefailed

Description

Task Compatibility module failed to upgrade existing scheduled tasks. Additional Data: Error Value: ResultCode.

Message #

Task Compatibility module failed to upgrade existing scheduled tasks. Additional Data: Error Value: %1.

Fields #

Name	Description
`ResultCode` UInt32

Event ID 717: Task Compatibility module failed to determine if upgrade is needed.

Provider: Microsoft-Windows-TaskScheduler
Channel: Operational
Collection Priority: Recommended (Yamato Security)
Task: Compatibilitymoduletasksupgradeundetermined

Description

Task Compatibility module failed to determine if upgrade is needed. Additional Data: Error Value: ResultCode.

Message #

Task Compatibility module failed to determine if upgrade is needed. Additional Data: Error Value: %1.

Fields #

Name	Description
`ResultCode` UInt32

Event ID 718: Task scheduler was unable to upgrade the credential store from the Beta 2 version.

Provider: Microsoft-Windows-TaskScheduler
Channel: System
Task: Credentialstoreupgradefailed

Description

Task scheduler was unable to upgrade the credential store from the Beta 2 version. You may need to re-register any tasks that require passwords. Additional Data: Error Value: ResultCode.

Message #

Task scheduler was unable to upgrade the credential store from the Beta 2 version.  You may need to re-register any tasks that require passwords. Additional Data: Error Value: %1.

Fields #

Name	Description
`ResultCode` UInt32

Event ID 719: To help optimize for performance, Task Scheduler has automatically disabled logging.

Provider: Microsoft-Windows-TaskScheduler
Channel: System
Level: Informational
Task: TaskSchedulerOperationallogwasdisabled

Description

To help optimize for performance, Task Scheduler has automatically disabled logging. To re-enable logging, please use Event Viewer.

Message #

To help optimize for performance, Task Scheduler has automatically disabled logging. To re-enable logging, please use Event Viewer.

Fields #

Name	Description
`Name`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 719,
    "version": 0,
    "level": 4,
    "task": 719,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-03-09T00:56:48.593820+00:00",
    "event_record_id": 2099,
    "correlation": {},
    "execution": {
      "process_id": 1780,
      "thread_id": 2060
    },
    "channel": "System",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "OpChannelDisabled"
  },
  "message": ""
}

Event ID 800: Maintenance state changed to Name (Last Run: hc_stateid).

Provider: Microsoft-Windows-TaskScheduler
Channel: Maintenance
Level: Informational
Task: Maintenancestatehaschanged

Description

Maintenance state changed to Name (Last Run: hc_stateid).

Message #

Maintenance state changed to %1 (Last Run: %2).

Fields #

Name	Description
`hc_stateid` UInt32
`LastRunDateTime` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}",
    "event_source_name": "",
    "event_id": 800,
    "version": 0,
    "level": 4,
    "task": 800,
    "opcode": 0,
    "keywords": 576460752303423488,
    "time_created": "2026-06-13T06:05:42.6248982+00:00",
    "event_record_id": 69,
    "correlation": {},
    "execution": {
      "process_id": 2100,
      "thread_id": 6392
    },
    "channel": "Microsoft-Windows-TaskScheduler/Maintenance",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "hc_stateid": "1",
    "LastRunDateTime": "‎6/‎13/‎2026 6:05 AM"
  },
  "message": "Maintenance state changed to 1 (Last Run: ‎6/‎13/‎2026 6:05 AM)."
}

Event ID 801: Maintenance launch operation failed.

Provider: Microsoft-Windows-TaskScheduler
Channel: Maintenance
Task: Maintenancelaunchfailed

Description

Maintenance launch operation failed. Additional error info: ErrorCode.

Message #

Maintenance launch operation failed. Additional error info: %1.

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 802: Maintenance re-configuration failed.

Provider: Microsoft-Windows-TaskScheduler
Channel: Maintenance
Task: Maintenancere_configurationfailed

Description

Maintenance re-configuration failed. Additional error info: ErrorCode.

Message #

Maintenance re-configuration failed. Additional error info: %1.

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 803: Maintenance Scheduler engine task "Task" cannot be accessed.

Provider: Microsoft-Windows-TaskScheduler
Channel: Maintenance
Task: MaintenanceSchedulerenginetaskerror

Description

Maintenance Scheduler engine task "Task" cannot be accessed. Additional error info: ErrorCode.

Message #

Maintenance Scheduler engine task "%1" cannot be accessed. Additional error info: %2.

Fields #

Name	Description
`Task` UnicodeString
`ErrorCode` UInt32

Event ID 804: Maintenance Scheduler has detected cyclic dependency for the following maintenance tasks: Task.

Provider: Microsoft-Windows-TaskScheduler
Channel: Maintenance
Task: Maintenancetaskcycledependencydetected

Description

Maintenance Scheduler has detected cyclic dependency for the following maintenance tasks: Task.

Message #

Maintenance Scheduler has detected cyclic dependency for the following maintenance tasks: %1.

Fields #

Name	Description
`Task` UnicodeString

Event ID 805: Maintenance Task "Task" is behind deadline.

Provider: Microsoft-Windows-TaskScheduler
Channel: Maintenance
Task: Maintenancetaskisbehinddeadline

Description

Maintenance Task "Task" is behind deadline.

Message #

Maintenance Task "%1" is behind deadline.

Fields #

Name	Description
`Task` UnicodeString

Event ID 806: Maintenance task "Task" processing error.

Provider: Microsoft-Windows-TaskScheduler
Channel: Maintenance
Task: Maintenancetaskprocessingerror

Description

Maintenance task "Task" processing error. Additional error info InfoCode.

Message #

Maintenance task "%1" processing error. Additional error info %2.

Fields #

Name	Description
`Task` UnicodeString
`InfoCode` UInt32

Event ID 807: Maintenance complete (launch type LauncherId).

Provider: Microsoft-Windows-TaskScheduler
Channel: Maintenance
Task: Maintenancecomplete

Description

Maintenance complete (launch type LauncherId).

Message #

Maintenance complete (launch type %1).

Fields #

Name	Description
`LauncherId` UInt32

Event ID 808: Maintenance Task "Name" requests computer wakeup during next regular maintenance run.

Provider: Microsoft-Windows-TaskScheduler
Channel: Maintenance
Level: Warning
Task: Maintenancewakeuprequested

Description

Maintenance Task "Name" requests computer wakeup during next regular maintenance run.

Message #

Maintenance Task "%1" requests computer wakeup during next regular maintenance run.

Fields #

Name	Description
`Task` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TaskScheduler",
    "guid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017",
    "event_source_name": "",
    "event_id": 808,
    "version": 0,
    "level": 3,
    "task": 808,
    "opcode": 0,
    "keywords": 576460752303423488,
    "time_created": "2023-10-26T04:22:01.225790+00:00",
    "event_record_id": 5,
    "correlation": {},
    "execution": {
      "process_id": 1860,
      "thread_id": 2172
    },
    "channel": "Microsoft-Windows-TaskScheduler/Maintenance",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "MaintenanceTaskWakeupRequested",
    "Task": "NT TASK\\Microsoft\\Windows\\.NET Framework\\.NET Framework NGEN v4.0.30319 Critical"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 809: Maintenance Scheduler Group Policy Settings are not properly specified for "FailureReason".

Provider: Microsoft-Windows-TaskScheduler
Channel: System
Task: MaintenanceSchedulerconfigurationerror

Description

Maintenance Scheduler Group Policy Settings are not properly specified for "FailureReason". Default settings are being used.

Message #

Maintenance Scheduler Group Policy Settings are not properly specified for "%1". Default settings are being used.

Fields #

Name Description

FailureReason UnicodeString

Known values

%%2304: An Error occured during Logon.
%%2305: The specified user account has expired.
%%2306: The NetLogon component is not active.
%%2307: Account locked out.
%%2308: The user has not been granted the requested logon type at this machine.
%%2309: The specified account's password has expired.
%%2310: Account currently disabled.
%%2311: Account logon time restriction violation.
%%2312: User not allowed to logon at this computer.
%%2313: Unknown user name or bad password.
%%2314: Domain sid inconsistent.
%%2315: Smartcard logon is required and was not used.

Event ID 998: DEBUG!

Provider: Microsoft-Windows-TaskScheduler
Channel: Debug
Task: MethodFailure
Opcode: Failure

Description

DEBUG! (File:Line) "Name" failed. (HRESULT).

Message #

DEBUG! (%3:%4) "%1" failed. (%2).

Fields #

Name	Description
`Name` UnicodeString
`HRESULT` UInt32
`File` UnicodeString
`Line` UInt32

Event ID 999: DEBUG!

Provider: Microsoft-Windows-TaskScheduler
Channel: Debug
Task: Debug

Description

DEBUG! "String".

Message #

DEBUG! "%1".

Fields #

Name	Description
`String` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID {DE7B24EA-73C8-4A09-985D-5BDADCFA9017}

Defined in schedsvc.dll, which carries the event manifest.

Observed on:

Win11-26200.6584, sample captured from a live trace, binary version 10.0.26100.1, captured 2026-06-02
WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)