01Fields in the event
- SubjectUserSid
- SubjectUserName
- SubjectDomainName
- SubjectLogonId
- TaskName
- TaskContent
02How to use it
Preserves the content of a task that no longer exists on disk; a create-run-delete sequence in a short window is typical of remote execution tools.
03Caveats
Requires Audit Other Object Access Events.
05Sources
- Microsoft Learn — 4699(S) A scheduled task was deleted checked 2026-10-18