SCHTASKS
Authorized use only. Offensive reference for systems you own or are explicitly permitted to test. You are responsible for staying within the law.
Windows Task Scheduler Command-line Tool. Create, modify, run, and delete scheduled tasks.
QUERY TASKS#
schtasks # List root tasks schtasks /query # Same as above schtasks /query /fo list # List format schtasks /query /fo table # Table format schtasks /query /fo csv # CSV format schtasks /query /v # Verbose output schtasks /query /v /fo list # Verbose list schtasks /query /tn "TaskName" # Specific task schtasks /query /tn "\Path\Task" # Task in folder schtasks /query /xml # XML output # Query remote system schtasks /query /s COMPUTER schtasks /query /s COMPUTER /u USER /p PASSWORD
CREATE TASKS#
BASIC SYNTAX#
schtasks /create /tn "TaskName" /tr "command" /sc schedule
SCHEDULE TYPES (/SC)#
/sc minute # Every N minutes /sc hourly # Every N hours /sc daily # Every N days /sc weekly # Every N weeks /sc monthly # Monthly /sc once # Run once /sc onstart # At system startup /sc onlogon # At user logon /sc onidle # When system is idle /sc onevent # On event log entry
EXAMPLES BY SCHEDULE#
# Every 5 minutes schtasks /create /tn "Task" /tr "C:\script.bat" /sc minute /mo 5 # Every hour schtasks /create /tn "Task" /tr "C:\script.bat" /sc hourly # Daily at specific time schtasks /create /tn "Task" /tr "C:\script.bat" /sc daily /st 09:00 # Weekly on specific days schtasks /create /tn "Task" /tr "C:\script.bat" /sc weekly /d MON,WED,FRI /st 08:00 # Monthly on specific day schtasks /create /tn "Task" /tr "C:\script.bat" /sc monthly /d 1 /st 00:00 # Run once at specific date/time schtasks /create /tn "Task" /tr "C:\script.bat" /sc once /st 14:00 /sd 2024/12/31 # At system startup schtasks /create /tn "Task" /tr "C:\script.bat" /sc onstart # At user logon schtasks /create /tn "Task" /tr "C:\script.bat" /sc onlogon # When idle for 10 minutes schtasks /create /tn "Task" /tr "C:\script.bat" /sc onidle /i 10 # On specific event schtasks /create /tn "Task" /tr "C:\script.bat" /sc onevent /ec Security /mo "*[System[EventID=4624]]"
COMMON OPTIONS#
/st 09:00 # Start time (HH:MM) /sd 2024/01/01 # Start date (YYYY/MM/DD) /ed 2024/12/31 # End date /et 17:00 # End time /du 0002:00 # Duration (HHHH:MM) /mo 5 # Modifier (interval) /d MON,TUE,WED # Days of week /m JAN,JUN,DEC # Months /i 10 # Idle time (minutes)
RUN AS OPTIONS#
/ru SYSTEM # Run as SYSTEM /ru "NT AUTHORITY\SYSTEM" # Same as above /ru "NT AUTHORITY\NetworkService" # Network Service /ru "NT AUTHORITY\LocalService" # Local Service /ru "DOMAIN\User" /rp "password" # Specific user /ru "DOMAIN\User" /rp * # Prompt for password /rl HIGHEST # Run with highest privileges /rl LIMITED # Run with limited privileges
ADDITIONAL OPTIONS#
/f # Force create (overwrite) /z # Delete after last run /k # Stop task at end time /it # Interactive only /np # No password stored /delay 0005:00 # Delay start (MMMM:SS)
FULL EXAMPLE#
schtasks /create ^
/tn "MyFolder\MyTask" ^
/tr "powershell.exe -File C:\script.ps1" ^
/sc daily ^
/st 03:00 ^
/ru SYSTEM ^
/rl HIGHEST ^
/f
WORKING DIRECTORY#
# Use cmd /c to set working directory schtasks /create /tn "Task" /tr "cmd /c cd C:\workdir && script.bat" /sc daily /st 09:00
MODIFY TASKS#
schtasks /change /tn "TaskName" /st 10:00 schtasks /change /tn "TaskName" /tr "new\command.exe" schtasks /change /tn "TaskName" /ru "DOMAIN\User" /rp "password" schtasks /change /tn "TaskName" /enable schtasks /change /tn "TaskName" /disable schtasks /change /tn "TaskName" /ed 2024/12/31
RUN TASKS#
schtasks /run /tn "TaskName" # Run immediately schtasks /run /tn "TaskName" /i # Interactive schtasks /run /s COMPUTER /tn "TaskName" # Remote
END TASKS#
schtasks /end /tn "TaskName" # Stop running task schtasks /end /s COMPUTER /tn "TaskName"
DELETE TASKS#
schtasks /delete /tn "TaskName" # Delete (prompts) schtasks /delete /tn "TaskName" /f # Force delete schtasks /delete /tn "Folder\*" /f # Delete folder contents schtasks /delete /s COMPUTER /tn "TaskName" /f
REMOTE TASKS#
schtasks /query /s COMPUTER schtasks /query /s COMPUTER /u DOMAIN\User /p Password schtasks /create /s COMPUTER /u DOMAIN\User /p Password /tn "Task" /tr "cmd.exe" /sc onstart /ru SYSTEM schtasks /run /s COMPUTER /tn "TaskName" schtasks /delete /s COMPUTER /tn "TaskName" /f
TASK FOLDERS#
# Create in subfolder schtasks /create /tn "\MyFolder\TaskName" /tr "cmd.exe" /sc daily /st 09:00 # Query subfolder schtasks /query /tn "\Microsoft\Windows\*" # Delete from folder schtasks /delete /tn "\MyFolder\TaskName" /f
IMPORT/EXPORT XML#
# Export to XML schtasks /query /tn "TaskName" /xml > task.xml # Import from XML schtasks /create /tn "NewTask" /xml task.xml # Create complex task via XML schtasks /create /tn "Task" /xml "C:\task.xml" /ru SYSTEM
SECURITY ANALYSIS#
# List all tasks schtasks /query /fo list /v # Find tasks with high privileges schtasks /query /fo list /v | findstr /i "Run As User" # Find tasks running as SYSTEM schtasks /query /fo list /v | findstr /i "SYSTEM" # Check task actions schtasks /query /tn "TaskName" /v /fo list | findstr /i "Task To Run" # Export all for analysis schtasks /query /fo csv /v > all_tasks.csv
PERSISTENCE TECHNIQUES#
# At startup (requires admin) schtasks /create /tn "Persistence" /tr "C:\payload.exe" /sc onstart /ru SYSTEM /rl HIGHEST /f # At user logon schtasks /create /tn "UserTask" /tr "C:\payload.exe" /sc onlogon /ru %USERNAME% # Hidden in subfolder schtasks /create /tn "\Microsoft\Windows\Maintenance\Task" /tr "C:\payload.exe" /sc daily /st 03:00 /ru SYSTEM /f # With delay schtasks /create /tn "Task" /tr "C:\payload.exe" /sc onstart /delay 0005:00 /ru SYSTEM
MONITORING#
# List recent task history wevtutil qe Microsoft-Windows-TaskScheduler/Operational /c:50 /rd:true /f:text # Event IDs # 106 - Task registered # 140 - Task updated # 141 - Task deleted # 200 - Task started # 201 - Task completed # 202 - Task failed
COMMON ISSUES#
# Task not running? # - Check "Run whether user is logged on or not" # - Check "Run with highest privileges" # - Verify path and permissions # - Check Task Scheduler service is running # Access denied? # - Run cmd as Administrator # - Use /ru SYSTEM for system tasks # - Verify remote credentials
QUICK REFERENCE#
# Query schtasks /query # List tasks schtasks /query /tn "TaskName" /v # Detailed view schtasks /query /fo csv > tasks.csv # Export # Create schtasks /create /tn "Task" /tr "cmd.exe" /sc daily /st 09:00 schtasks /create /tn "Task" /tr "cmd.exe" /sc onstart /ru SYSTEM /rl HIGHEST # Control schtasks /run /tn "TaskName" # Run now schtasks /end /tn "TaskName" # Stop schtasks /change /tn "Task" /disable # Disable schtasks /change /tn "Task" /enable # Enable # Delete schtasks /delete /tn "TaskName" /f # Remote schtasks /query /s COMPUTER /u USER /p PASS schtasks /create /s COMPUTER /u USER /p PASS /tn "Task" /tr "cmd.exe" /sc once /st 12:00 # Schedule types /sc minute /mo 5 # Every 5 minutes /sc hourly # Every hour /sc daily /st 09:00 # Daily at 9am /sc weekly /d MON /st 08:00 # Weekly Monday 8am /sc monthly /d 1 /st 00:00 # 1st of month /sc onstart # At boot /sc onlogon # At logon /sc onidle /i 10 # When idle 10min