Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. winevt
  5. Logs
  6. Microsoft-Windows-TaskScheduler%4Operational.evtx
LogRisk: Caution

Microsoft-Windows-TaskScheduler%4Operational.evtx C:\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Operational.evtx

TaskScheduler%4Operational.evtx: Task Scheduler log (task start, end, creation and errors). History has to be turned on.

Updated on By AltF4 Formation

What it’s for

Microsoft-Windows-TaskScheduler/Operational tells the life story of scheduled tasks: triggering, action launch, completion, errors, creation and deletion. You open it to understand why a task did not run or failed, and to spot a task that someone else added.

What it contains

  • 100 and 200: a task and an action starting. 129: the action’s process being created.
  • 102 and 201: the task and the action finishing. The return code is in the message of event 201.
  • 101: the task failed to start.
  • 106, 140 and 141: a task being registered, updated and deleted.

It is disabled by default. Turn on all-tasks history in the Task Scheduler console (“Enable All Tasks History”) or with wevtutil sl. Until that is done, do not count on complete content.

Risks and best practices

  • Creation events (106) help detect persistence, so do not clear the log during troubleshooting or an investigation.
  • On servers and sensitive workstations, turn history on and forward the log. For task creation, the Security log adds event 4698 if auditing is enabled.
  • Task and account names show up in it, so handle copies with care.

Useful commands

Fenêtre de terminal
# Log status (enabled or not, maximum size)
wevtutil gl "Microsoft-Windows-TaskScheduler/Operational"


# Enable the log (as administrator)
wevtutil sl "Microsoft-Windows-TaskScheduler/Operational" /e:true


# Latest task creations (106) and start failures (101)
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-TaskScheduler/Operational'; Id=106,101} -MaxEvents 30 |
    Select-Object TimeCreated, Id, Message

Format

Binary XML file (.evtx). The “/” in the log name becomes “%4” in the file name.

Rotation and archiving

Maximum size and retention are set in the log properties or through Group Policy, as for any .evtx log. The oldest events are overwritten when it is full, unless archiving is configured. wevtutil epl exports a copy.

How to read it

Event Viewer > Applications and Services Logs > Microsoft > Windows > TaskScheduler > Operational. For an exported file, run Get-WinEvent -Path on the .evtx. Match the task name against the definitions in C:\Windows\System32\Tasks.

Report a mistake