ZEKASTRA

Microsoft-Windows-TaskScheduler/OperationalScheduled tasks

200 · Action started

Logged when Task Scheduler launches an action in an instance of a task. The message names the task, the action and the instance.

01Fields in the event

The cited Microsoft page does not list field names for this event.

02How to use it

Gives execution times for a task; the action string identifies the program run. Pair with 201 by instance and with 4688 for the process.

03Caveats

Cited from archived Windows Server 2008 R2 documentation; message only, no structured field list.

05Sources

  1. Microsoft Learn — Event ID 200 — Task Monitoring and Control checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.