How to tell when a Scheduled Task was CREATED, in Windows Server 2003

scheduled-taskwindows-server-2003

(Oops I asked this on SuperUser first on accident…)

I am trying to find out if someone added a new Scheduled Task to a Windows 2003 Server. How can I find the date a scheduled task was actually created? Exploring Scheduled Tasks in Explorer doesn't show Created or Modified as a column value.

Thanks in advance for any help!

Best Answer

The quickest way I can think of to show the creation time on a "Scheduled Task" entry would be to execute:

attrib -r -s -h %SystemRoot%\Tasks\Desktop.ini
ren %SystemRoot%\Tasks\Desktop.ini Desktop.ini.foo
explorer %SystemRoot%\Tasks

This would open the %SystemRoot%\Tasks folder in a "normal" Explorer view and would let you review the times on the files stored there.

When you're done, rename and re-apply attributes to "desktop.ini" to make things normal again:

ren %SystemRoot%\Tasks\Desktop.ini.foo Desktop.ini
attrib +r +s +h %SystemRoot%\Tasks\Desktop.ini

It's a cheap trick, but it should show you the creation time on the task file for the task you're interested in.

Related Topic