{
	"id": "1c9010fb-35c8-4e43-a92f-d0d22b9e92e1",
	"created_at": "2026-04-06T00:19:59.089858Z",
	"updated_at": "2026-04-10T03:22:04.426683Z",
	"deleted_at": null,
	"sha1_hash": "2e1afffcabc286f4a49f7f46ba5274ce94399c10",
	"title": "At",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 81304,
	"plain_text": "At\r\nArchived: 2026-04-05 18:32:40 UTC\r\nSchedules commands and programs to run on a computer at a specified time and date. You can use at only when\r\nthe Schedule service is running. Used without parameters, at lists scheduled commands.\r\nSyntax\r\nat [\\\\ComputerName] [{[ID] [/delete]|/delete [/yes]}]\r\nat [[\\\\ComputerName] hours:minutes [/interactive] [{/every:date[,...]|/next:date[,...]}] command]\r\nParameters\r\n\\\\ ComputerName   : Specifies a remote computer. If you omit this parameter, at schedules the commands and\r\nprograms on the local computer.\r\nID   : Specifies the identification number assigned to a scheduled command.\r\n/delete   : Cancels a scheduled command. If you omit ID, all of the scheduled commands on the computer are\r\ncanceled.\r\n/yes   : Answers yes to all queries from the system when you delete scheduled events.\r\nhours : minutes   : Specifies the time when you want to run the command. Time is expressed as\r\nhours**:**minutes in 24-hour notation (that is, 00:00 [midnight] through 23:59).\r\n/interactive   : Allows command to interact with the desktop of the user who is logged on at the time command\r\nruns.\r\n/every:   : Runs command on every specified day or days of the week or month (for example, every Thursday, or\r\nthe third day of every month).\r\ndate   : Specifies the date when you want to run the command. You can specify one or more days of the week (that\r\nis, type M,T,W,Th,F,S,Su) or one or more days of the month (that is, type 1 through 31). Separate multiple date\r\nentries with commas. If you omit date, at uses the current day of the month.\r\n/next:   : Runs command on the next occurrence of the day (for example, next Thursday).\r\ncommand   : Specifies the Windows command, program (that is, .exe or .com file), or batch program (that is, .bat\r\nor .cmd file) that you want to run. When the command requires a path as an argument, use the absolute path (that\r\nhttps://technet.microsoft.com/en-us/library/bb490866.aspx\r\nPage 1 of 5\n\nis, the entire path beginning with the drive letter). If the command is on a remote computer, specify Universal\r\nNaming Convention (UNC) notation for the server and share name, rather than a remote drive letter.\r\n/?   : Displays help at the command prompt.\r\nSchtasks is a more powerful superset command-line scheduling tool and includes all the functionality\r\nfound in the at command-line utility. Use schtasks instead of at for all command-line scheduling tasks. For\r\nmore information about schtasks, see Related Topics.\r\nUsing at \r\nTo use at, you must be a member of the local Administrators group.\r\nLoading Cmd.exe\r\nAt does not automatically load Cmd.exe, the command interpreter, before running commands. If you are\r\nnot running an executable (.exe) file, you must explicitly load Cmd.exe at the beginning of the command as\r\nfollows:\r\ncmd /c dir \u003e c:\\test.out\r\nViewing scheduled commands\r\nWhen you use at without command-line options, scheduled tasks appear in a table formatted similar to the\r\nfollowing:\r\nStatusIDDayTimeCommand Line\r\nOK      1    Each F    4:30 PM     net send group leads status due OK      2    Each M    12:00 AM    chkstor \u003e\r\ncheck.file OK      3    Each F    11:59 PM    backup2.bat\r\nIncluding identification number (ID)\r\nWhen you include identification number (ID) with at at a command prompt, information for a single entry\r\nappears in a format similar to the following:\r\nTask ID: 1\r\nStatus: OK Schedule: Each F Time of Day: 4:30 PM Command: net send group leads status due\r\nAfter you schedule a command with **at**, especially a command that has command-line options, check that the co\r\nViewing results\r\nCommands scheduled with at run as background processes. Output is not displayed on the computer\r\nscreen. To redirect output to a file, use the redirection symbol (\u003e). If you redirect output to a file, you need\r\nhttps://technet.microsoft.com/en-us/library/bb490866.aspx\r\nPage 2 of 5\n\nto use the escape symbol (^) before the redirection symbol, whether you are using at at the command line\r\nor in a batch file. For example, to redirect output to Output.text, type:\r\nat 14:45 c:\\test.bat ^\u003ec:\\output.txt\r\nThe current directory for the executing command is the systemroot folder.\r\nChanging system time\r\nIf you change the system time at a computer after you schedule a command to run with at, synchronize the\r\nat scheduler with the revised system time by typing at without command-line options.\r\nStoring commands\r\nScheduled commands are stored in the registry. As a result, you do not lose scheduled tasks if you restart\r\nthe Schedule service.\r\nConnecting to network drives\r\nDo not use a redirected drive for scheduled jobs that access the network. The Schedule service might not be\r\nable to access the redirected drive, or the redirected drive might not be present if a different user is logged\r\non at the time the scheduled task runs. Instead, use UNC paths for scheduled jobs. For example:\r\nat 1:00pm my_backup \\\\server\\share\r\nDo not use the following syntax, where x: is a connection made by the user:\r\nat 1:00pm my_backup x:\r\nIf you schedule an at command that uses a drive letter to connect to a shared directory, include an at\r\ncommand to disconnect the drive when you are finished using the drive. If the drive is not disconnected,\r\nthe assigned drive letter is not available at the command prompt.\r\nExamples\r\nTo display a list of commands scheduled on the Marketing server, type:\r\nat \\\\marketing \r\nTo learn more about a command with the identification number 3 on the Corp server, type:\r\nat \\\\corp 3 \r\nTo schedule a net share command to run on the Corp server at 8:00 A.M. and redirect the listing to the\r\nMaintenance server, in the Reports shared directory, and the Corp.txt file, type:\r\nat \\\\corp 08:00 cmd /c \"net share reports=d:\\marketing\\reports \u003e\u003e \\\\maintenance\\reports\\corp.txt\" \r\nTo back up the hard drive of the Marketing server to a tape drive at midnight every five days, create a batch\r\nprogram called Archive.cmd, which contains the backup commands, and then schedule the batch program to run,\r\nhttps://technet.microsoft.com/en-us/library/bb490866.aspx\r\nPage 3 of 5\n\ntype:\r\nat \\\\marketing 00:00 /every:5,10,15,20,25,30 archive \r\nTo cancel all commands scheduled on the current server, clear the at schedule information as follows:\r\nat /delete \r\nTo run a command that is not an executable (that is, .exe) file, precede the command with cmd /c to load Cmd.exe\r\nas follows:\r\ncmd /c dir \u003e c:\\test.out \r\nFormatting legend\r\nFormat Meaning\r\nItalic Information that the user must supply\r\nBold\r\nElements that the user must type exactly as\r\nshown\r\nEllipsis (...)\r\nParameter that can be repeated several times in a\r\ncommand line\r\nBetween brackets ([]) Optional items\r\nBetween braces ({}); choices separated by pipe (|).\r\nExample: {even|odd}\r\nSet of choices from which the user must choose\r\nonly one\r\nCourier font Code or program output\r\nCommand-line reference A-Z\r\nUsing command redirection operators\r\nSchtasks\r\nhttps://technet.microsoft.com/en-us/library/bb490866.aspx\r\nPage 4 of 5\n\nSource: https://technet.microsoft.com/en-us/library/bb490866.aspx\r\nhttps://technet.microsoft.com/en-us/library/bb490866.aspx\r\nPage 5 of 5",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://technet.microsoft.com/en-us/library/bb490866.aspx"
	],
	"report_names": [
		"bb490866.aspx"
	],
	"threat_actors": [],
	"ts_created_at": 1775434799,
	"ts_updated_at": 1775791324,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/2e1afffcabc286f4a49f7f46ba5274ce94399c10.pdf",
		"text": "https://archive.orkl.eu/2e1afffcabc286f4a49f7f46ba5274ce94399c10.txt",
		"img": "https://archive.orkl.eu/2e1afffcabc286f4a49f7f46ba5274ce94399c10.jpg"
	}
}