Event ID 4702 — Modification of a planned task

An existing planned task has been modified.

Source of event

Microsoft-Windows-Security-Auditing — Security category.

Possible causes

• Legitimate maintenance
• Change script
• Alteration of an existing task

Verifications to be carried out

1. Compare the old configuration if available
2. Control the program executed
3. Check the account that made the change

Useful orders….

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4702} -MaxEvents 20

To be retained….

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.