IT Toolbox
IT Toolbox

Event ID 4698 — Creation of a planned task

TopicWindows Server →
View my favorites

A new planned task has been created.

Source of event

Microsoft-Windows-Security-Auditing — Security category.

Possible causes

  • Software installation
  • Administrative automation
  • Persistence mechanism

Verifications to be carried out

  1. Read the XML of the task
  2. Identify the action executed
  3. Check account and trigger

Useful orders….

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4698} -MaxEvents 20

To be retained….

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.

♡ 0