ZEKASTRA

SecurityScheduled tasks

4698 · A scheduled task was created

Generated every time a new scheduled task is created. TaskContent contains the full task XML, including triggers, actions and the account it runs as.

01Fields in the event

  • SubjectUserSid
  • SubjectUserName
  • SubjectDomainName
  • SubjectLogonId
  • TaskName
  • TaskContent

02How to use it

Read the action command and trigger in TaskContent; tasks at the library root (\TaskName) deserve attention. Compare with the task file under System32\Tasks and with TaskScheduler events 106, 200 and 201.

03Caveats

Requires Audit Other Object Access Events. Windows 10 1903 and later add client process fields (event version 1).

05Sources

  1. Microsoft Learn — 4698(S) A scheduled task was created checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.