01Location
- C:\Windows\System32\Tasks\<folder>\<task name>
- C:\Windows\SysWOW64\Tasks
- C:\Windows\Tasks\*.job (Windows XP)
- SOFTWARE hive: Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree and \Tasks\{GUID} (also Boot, Logon, Plain)
- C:\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Operational.evtx
02Questions it answers
- Which tasks exist, what do they execute and under which principal?
- Do the XML files and the TaskCache registry entries agree?
- Was a task created recently (event 4698 with its XML content)?
- When did a legacy .job task last run?
03Format and versions
| Format | XML defined by the Task Scheduler schema: Task with RegistrationInfo, Triggers, Settings, Data, Principals and the required Actions element. TaskCache\Tasks\{GUID} holds Path, Hash (SHA-256, or CRC32 before KB2305420), Triggers and DynamicInfo (28 bytes on Vista/7, 36 bytes on 8/10). Legacy .job files use fixed and variable data sections with SYSTEMTIME values. |
|---|---|
| Applies to | XML tasks and TaskCache: Windows Vista and later. .job files and the SchedulingAgent key: Windows XP. |
04Key fields
| Field | What it tells you |
|---|---|
| Actions | Required element describing what the task runs. |
| Triggers / Principals / Settings | When the task runs, as whom, and with which behaviour. |
| TaskCache Tree Id | GUID linking a Tree entry to TaskCache\Tasks. |
| TaskCache Path / Hash | Task path relative to Tree and integrity hash of the XML file (byte-order mark excluded). |
| DynamicInfo | Binary value with FILETIMEs whose meanings (registration, launch) are not confirmed. |
| Event 4698 Task Content | XML content of the new task as logged in the Security log. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| DynamicInfo time values | FILETIME | winreg-kb marks them as unknown (possibly last registration and launch time). |
| TaskCache Triggers value times | FILETIME | Appear to be stored in local time rather than UTC. |
| .job Last run time | SYSTEMTIME (16 bytes) | 0 if the task never ran. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Collect the Tasks directories, the SOFTWARE hive and the TaskScheduler Operational and Security logs.
- Parse each XML task and list its actions, triggers and principal.
- Reconcile TaskCache Tree/Tasks entries with files on disk and compare stored hashes.
- Review 4698 events and Operational log entries for creation and execution history.
07Interpretation pitfalls
- DynamicInfo field meanings are unconfirmed; report them with that qualification.
- Event 4698 is only generated when 'Audit Other Object Access Events' is enabled.
- The TaskCache hash algorithm changed with KB2305420; compare against the algorithm that applies to the system's patch level.
09Sources
- Task scheduler libyal / winreg-kb · checked 2026-10-14
- Task Scheduler Schema Microsoft Learn · checked 2026-10-14
- 4698(S): A scheduled task was created. Microsoft Learn · checked 2026-10-14
- Job file format libyal / dtformats (J. Metz) · checked 2026-10-14
- Windows artifact definitions (windows.yaml) ForensicArtifacts / artifacts · checked 2026-10-14