Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. Tasks
FolderRisk: Do not touch

Tasks C:\Windows\System32\Tasks

C:\Windows\System32\Tasks: XML definitions of Task Scheduler tasks, extensionless, one per task. Change them only through Task Scheduler.

Updated on By AltF4 Formation

What it’s for

Tasks stores the Task Scheduler (2.0) task definitions as extensionless XML files. The tree mirrors the folders of the Task Scheduler Library, for example Microsoft\Windows\.... It is an internal location: the supported way in is the Task Scheduler API (ITaskFolder) or the ScheduledTasks cmdlets. The old C:\Windows\Tasks folder keeps the .job tasks of the legacy engine.

What it contains

  • One XML file per task: triggers, actions, run-as account, conditions.
  • Subfolders per vendor and component (Microsoft, Windows, third-party vendors).
  • Tasks created by applications, antivirus, update tools and Group Policy.

Risks and best practices

  • Task Scheduler also keeps its task information in the Registry, under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache. A file created, edited or deleted by hand puts the two out of step and can leave the task unusable. Use Task Scheduler, schtasks or the cmdlets.
  • Scheduled tasks are a classic persistence point for malware: audit unknown tasks, including those with a name close to a Microsoft task.
  • Export a task with Export-ScheduledTask before changing it.

Useful commands

Fenêtre de terminal
# List tasks that are not disabled
Get-ScheduledTask | Where-Object State -ne 'Disabled' | Select-Object TaskPath, TaskName, State


# Export a task's XML definition
Export-ScheduledTask -TaskName 'TaskName' -TaskPath '\'


# Tasks whose run-as account is not a system account
Get-ScheduledTask | Select-Object TaskPath, TaskName, @{n='Account';e={$_.Principal.UserId}} | Where-Object Account -notin 'SYSTEM','LOCAL SERVICE','NETWORK SERVICE'

Report a mistake