Microsoft-Windows-TaskScheduler/OperationalScheduled tasks

106 · Task registered

Logged by Microsoft-Windows-TaskScheduler when a user registers (creates) a task. The message names the task and the user.

01Fields in the event

The cited Microsoft page does not list field names for this event.

02How to use it

Useful where Security auditing for 4698 was not enabled. Combine with 200/201 to show that the task actually ran.

03Caveats

The Operational log may be disabled or small and roll over quickly. Cited from archived Windows Server 2008 R2 documentation.

05Sources

  1. Microsoft Learn — Event ID 106 — General Task Registration checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.