Schtasks CMD .bat trouble

Question

When i run the task it starts the .exe fine but the event ID isn't triggering the .exe automatically.

@echo off
@SCHTASKS /Create /TN Security_Microsoft-Windows-Security-Auditing_4624 /TR "C:\Program Files (x86)\example.exe" /SC ONEVENT /EC Security /MO "*[Security[(EventID=4624)]]" /f
@exit
:h
goto h

(This is saved to notepad as a .bat and run as administrator)

Try `/MO *[Security/EventId=4624]`. It's been a while since I supported Windows TaskScheduler. — jwdonahue, Feb 05 '20 at 00:21
You trying to run this as the currently logged on user. What does your program actually do? — jwdonahue, Feb 06 '20 at 21:59
It isn't the actual event ID im working with. The .exe is a python alert program I coded. When I right click in event log and assign an ID to run a program it runs fine. But when I run the .bat it shows up as a task and when running does run the .py file but doesn't run when the event ID is triggered — FATCAT47, Feb 07 '20 at 21:14

score 1 · Accepted Answer · answered Feb 07 '20 at 22:07

After you use the wizard, in Event Viewer, to bind a task to the event, start Computer Management => Task Scheduler and drill down to Task Scheduler Library => Event Viewer Tasks, find the task named Security_Microsoft-Windows-Security-Auditing_4624 and export it to XML.

At this point you can simply include that XML file with your script and modify the script to import the XML task description on the system. Optionally, you can compare that XML file with one exported from the task you created using the CLI, to see the differences. The differences in Subscription content of the EventTrigger node will be instructive.

Schtasks CMD .bat trouble

1 Answers1