How to tell when a Scheduled Task was CREATED, in Windows Server 2003

Question

(Oops I asked this on SuperUser first on accident...)

I am trying to find out if someone added a new Scheduled Task to a Windows 2003 Server. How can I find the date a scheduled task was actually created? Exploring Scheduled Tasks in Explorer doesn't show Created or Modified as a column value.

Thanks in advance for any help!

Solution 1

The quickest way I can think of to show the creation time on a "Scheduled Task" entry would be to execute:

attrib -r -s -h %SystemRoot%\Tasks\Desktop.ini
ren %SystemRoot%\Tasks\Desktop.ini Desktop.ini.foo
explorer %SystemRoot%\Tasks

This would open the %SystemRoot%\Tasks folder in a "normal" Explorer view and would let you review the times on the files stored there.

When you're done, rename and re-apply attributes to "desktop.ini" to make things normal again:

ren %SystemRoot%\Tasks\Desktop.ini.foo Desktop.ini
attrib +r +s +h %SystemRoot%\Tasks\Desktop.ini

It's a cheap trick, but it should show you the creation time on the task file for the task you're interested in.

Solution 2

dir /t:c %systemroot%\Tasks\"taskname".job

Solution 3

Use this link...

http://support.microsoft.com/kb/814596

Schtasks /Query

Comments

[user27933]

Thanks Anand for the input. I didn't know about this tool, so thanks! Using it though, even w/the /v option, I didn't see Created or Creation Date as a listed property/attribute. Am I just not seeing it for some reason?

[muffl0n]

RE: Maxwell, the api you are referring to is only availabe in VISTA and Server 2008

[JJJJNR]

schtasks /v shows you the "starting on xx/xx/20xx etc.