ZEKASTRA

SecurityScheduled tasks

4702 · A scheduled task was updated

Generated every time a scheduled task is updated or changed. TaskContentNew holds the new XML definition.

01Fields in the event

  • SubjectUserSid
  • SubjectUserName
  • SubjectDomainName
  • SubjectLogonId
  • TaskName
  • TaskContentNew

02How to use it

Look for existing, legitimate-looking tasks whose action was replaced; compare TaskContentNew with the previous 4698 or a known-good copy.

03Caveats

Requires Audit Other Object Access Events. The previous definition is not included in this event.

05Sources

  1. Microsoft Learn — 4702(S) A scheduled task was updated checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.