An existing planned task has been modified.
Source of event
Microsoft-Windows-Security-Auditing — Security category.
Possible causes
- Legitimate maintenance
- Change script
- Alteration of an existing task
Verifications to be carried out
- Compare the old configuration if available
- Control the program executed
- Check the account that made the change
Commands
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4702} -MaxEvents 20Key takeaways
An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.