Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. Tasks
FolderRisk: Caution

Tasks C:\Windows\Tasks

Legacy scheduled tasks folder (.job files of Task Scheduler 1.0). Current tasks live in System32\Tasks.

Updated on By AltF4 Formation

What it’s for

C:\Windows\Tasks is the task folder of the legacy Task Scheduler (version 1.0, Windows 2000 through Server 2003): each task was a file named after it with the .job extension. It remains for compatibility with older applications.

What it contains

  • Nothing, or almost nothing, on a recent Windows: current tasks are XML files in C:\Windows\System32\Tasks and registry entries.
  • Possibly .job files created by older applications or by the 1.0 scheduling API.
  • Sometimes files the scheduler did not create, which is abnormal.

Risks and best practices

  • Keep the folder: the scheduler may expect it for compatibility tasks.
  • By default, authenticated users can write here. That is why AppLocker and application allow-list bypass lists name it: an executable dropped here can run where Program Files would be refused. Add it to your monitoring and blocking rules.
  • An unexpected executable here is suspicious: malware can hide in it.
  • Create and manage your tasks with Task Scheduler, schtasks or the ScheduledTasks cmdlets, never by dropping a file into this folder.

Useful commands

Fenêtre de terminal
# Folder content and access rights
Get-ChildItem "$env:windir\Tasks" -Force
icacls "$env:windir\Tasks"


# Current scheduled tasks, excluding Microsoft's
Get-ScheduledTask | Where-Object TaskPath -notlike '\Microsoft\*' | Select-Object TaskPath, TaskName, State

Report a mistake