{
	"id": "ba155184-aa3b-41ca-90ba-c243f2cf9fde",
	"created_at": "2026-04-06T00:14:06.877571Z",
	"updated_at": "2026-04-10T03:35:21.461351Z",
	"deleted_at": null,
	"sha1_hash": "ca1accaed106f3da0eee879d4650bcba62561e20",
	"title": "Schtasks",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 148261,
	"plain_text": "Schtasks\r\nArchived: 2026-04-05 17:02:40 UTC\r\nSchedules commands and programs to run periodically or at a specific time. Adds and removes tasks from the schedule,\r\nstarts and stops tasks on demand, and displays and changes scheduled tasks.\r\nTo view the command syntax, click the following command:\r\nschtasks create\r\nCreates a new scheduled task.\r\nSyntax\r\nschtasks /create /tn TaskName /tr TaskRun /sc schedule [/mo modifier] [/d day] [/m month[,month...] [/i IdleTime] [/st StartTime] [/sd StartDate] [/ed \r\n[/u [domain\\]user /p password]] [/ru {[Domain\\]User | \"System\"} [/rp Password]] /? \r\nParameters\r\n/tn   TaskName   : Specifies a name for the task.\r\n/tr   TaskRun   : Specifies the program or command that the task runs. Type the fully qualified path and file name of an\r\nexecutable file, script file, or batch file. If you omit the path, SchTasks.exe assumes that the file is in the\r\nSystemroot\\System32 directory.\r\n/sc   schedule   : Specifies the schedule type. Valid values are MINUTE, HOURLY, DAILY, WEEKLY, MONTHLY, ONCE,\r\nONSTART, ONLOGON, ONIDLE.\r\nValue Description\r\nMINUTE, HOURLY, DAILY,\r\nWEEKLY, MONTHLY\r\nSpecifies the time unit for the schedule.\r\nONCE The task runs once at a specified date and time.\r\nONSTART\r\nThe task runs every time the system starts. You can specify a start date, or run\r\nthe task the next time the system starts.\r\nONLOGON\r\nThe task runs whenever a user (any user) logs on. You can specify a date, or run\r\nthe task the next time the user logs on.\r\nONIDLE\r\nThe task runs whenever the system is idle for a specified period of time. You can\r\nspecify a date, or run the task the next time the system is idle.\r\n/mo   modifier   : Specifies how often the task runs within its schedule type. This parameter is required for a MONTHLY\r\nschedule. This parameter is valid, but optional, for a MINUTE, HOURLY, DAILY, or WEEKLY schedule. The default value\r\nis 1.\r\nSchedule type Modifier Description\r\nMINUTE 1 - 1439\r\nThe task runs every\r\nn minutes.\r\nhttps://technet.microsoft.com/en-us/library/bb490996.aspx\r\nPage 1 of 15\n\nSchedule type Modifier Description\r\nHOURLY 1 - 23\r\nThe task runs every\r\nn hours.\r\nDAILY 1 - 365\r\nThe task runs every\r\nn days.\r\nWEEKLY 1 - 52\r\nThe task runs every\r\nn weeks.\r\nMONTHLY 1 - 12\r\nThe task runs every\r\nn months.\r\nLASTDAY The task runs on the last day of the month.\r\nFIRST, SECOND,\r\nTHIRD, FOURTH, LAST\r\nUse with the /d day parameter to run a task on a particular\r\nweek and day. For example, on the third Wednesday of the\r\nmonth.\r\n/d   day   : Specifies a day of the week or a day of a month. Valid only with a WEEKLY or MONTHLY schedule.\r\nSchedule\r\ntype\r\nDay values\r\nWEEKLY Optional. Valid values are MON - SUN and * (every day). MON is the default.\r\nMONTHLY\r\nA value of MON - SUN is required when the FIRST, SECOND, THIRD, FOURTH, or LAST modifier\r\n(/mo) is used. A value of 1 - 31 is optional and is valid only with no modifier or a modifier of the 1 - 12\r\ntype. The default is day 1 (the first day of the month).\r\n/m   month [ , month ...] : Specifies a month of the year. Valid values are JAN - DEC and * (every month). The /m\r\nparameter is valid only with a MONTHLY schedule. It is required when the LASTDAY modifier is used. Otherwise, it is\r\noptional and the default value is * (every month).\r\n/i   IdleTime   : Specifies how many minutes the computer is idle before the task starts. Type a whole number from 1 to 999.\r\nThis parameter is valid only with an ONIDLE schedule, and then it is required.\r\n/st   StartTime   : Specifies the time of day that the task starts in HH:MM:SS 24-hour format. The default value is the current\r\nlocal time when the command completes. The /st parameter is valid with MINUTE, HOURLY, DAILY, WEEKLY,\r\nMONTHLY, and ONCE schedules. It is required with a ONCE schedule.\r\n/sd   StartDate   : Specifies the date that the task starts in MM/DD/YYYY format. The default value is the current date. The\r\n/sd parameter is valid with all schedules, and is required for a ONCE schedule.\r\n/ed   EndDate   : Specifies the last date that the task is scheduled to run. This parameter is optional. It is not valid in a\r\nONCE, ONSTART, ONLOGON, or ONIDLE schedule. By default, schedules have no ending date.\r\n/s   Computer   : Specifies the name or IP address of a remote computer (with or without backslashes). The default is the\r\nlocal computer.\r\n/u [ domain \\] user   : Runs the command with the permissions of the specified user account. By default, the command runs\r\nwith the permissions of the user logged on to the computer running SchTasks.\r\nhttps://technet.microsoft.com/en-us/library/bb490996.aspx\r\nPage 2 of 15\n\n/p   password   : Specifies the password of the user account specified in the /u parameter. This parameter is required when\r\nthe /u parameter is used.\r\n/ru {[ Domain \\] User | \"System\" } : Runs the tasks with the permission of the specified user account. By default, the task\r\nruns with the permissions of the user logged on to the computer running SchTasks.\r\nValue Description\r\n[Domain\\]User Specifies a user account.\r\n\"System\" or \"\" Specifies the NT Authority\\System account, which is used by the operating system.\r\n/rp   Password   : Specifies the password of the user account that is specified in the /ru parameter. If you omit this parameter\r\nwhen specifying a user account, SchTasks.exe prompts you for the password and obscures the text you type. Tasks run with\r\nwith permissions of the NT Authority\\System account do not require a password and SchTasks.exe does not prompt for one.\r\n/? : Displays help at the command prompt.\r\nUsing the /s, /u, and /p command-line options\r\nThe /u and /p command-line options are available only when you use /s. You must use /p with /u to provide the user's\r\npassword.\r\nSchTasks.exe does not verify program file locations or user account passwords. If you do not enter the correct file\r\nlocation or the correct password for the user account, the task is created, but it does not run. Also, if the password for\r\nan account changes or expires, and you do not change the password saved in the task, then the task does not run.\r\nThe NT Authority\\System account does not have interactive logon rights. Users do not see and cannot interact with\r\nprograms run with system permissions.\r\nEach task runs only one program. However, you can create a batch file that starts multiple tasks, and then schedule a\r\ntask that runs the batch file.\r\nYou can test a task as soon as you create it. Use the run operation to test the task and then check the SchedLgU.txt\r\nfile (Systemroot\\SchedLgU.txt) for errors.\r\nSyntax and examples for each schedule type\r\nTo view the command syntax, click a command:\r\nschtasks create minute\r\nSyntax\r\nschtasks /create /tn TaskName /tr TaskRun /sc minute [/mo {1 -\r\n1439}] [/st StartTime] [/sd StartDate] [/ed EndDate] [/s computer [/u [domain\\]user /p password]] [/ru {[Domain\\]User |\r\n\"System\"} [/rp Password]] \r\nExample\r\nTo schedule a task to run every 20 minutes\r\nThe following command schedules a security script, Sec.vbs, to run every 20 minutes. Because the command does not\r\ninclude a starting date or time, the task starts 20 minutes after the command completes, and runs every 20 minutes thereafter\r\nwhenever the system is running. Notice that the security script source file is located on a remote computer, but that the task\r\nis scheduled and executes on the local computer.\r\nschtasks /create /sc minute /mo 20 /tn \"Security Script\" /tr \\\\central\\data\\scripts\\sec.vbs\r\nIn response, SchTasks.exe displays a message explaining that the task will run with the permissions of the current user and\r\nrequests the current user's password. When you enter the password, SchTasks.exe obscures the text you type.\r\nThe task will be created under current logged-in user name.\r\nPlease enter the password\r\nhttps://technet.microsoft.com/en-us/library/bb490996.aspx\r\nPage 3 of 15\n\n************\r\nThen, SchTasks.exe displays a message indicating that the task is scheduled:\r\nSUCCESS: The Scheduled Task \"Security Script\" has successfully been created. \r\nA query shows the task that the command scheduled:\r\nTaskName Next Run Time Status\r\n========================= ======================== ==============\r\nSecurity Script 10:50:00 AM , 4/4/2001\r\nschtasks create hourly\r\nSyntax\r\nschtasks /create /tn TaskName /tr TaskRun /sc hourly [/mo {1 -\r\n365}] [/st StartTime] [/sd StartDate] [/ed EndDate] [/s computer [/u [domain\\]user /p password]] [/ru {[Domain\\]User |\r\n\"System\"} [/rp Password]] \r\nExample\r\nTo schedule a command that runs every hour at five minutes past the hour\r\nThe following command schedules the MyApp program to run hourly beginning at five minutes past midnight. Because the\r\n/mo parameter is omitted, the command uses the default value for the hourly schedule, which is every (1) hour. If this\r\ncommand is issued after 12:05 A.M., the program will not run until the next day.\r\nschtasks /create /sc hourly /st 00:05:00 /tn \"My App\" /tr c:\\apps\\myapp.exe\r\nTo schedule a command that runs every five hours\r\nThe following command schedules the MyApp program to run every five hours beginning on the first day of March 2001. It\r\nuses the /mo parameter to specify the interval and the /sd parameter to specify the start date. Because the command does not\r\nspecify a start time, the current time is used as the start time.\r\nschtasks /create /sc hourly /mo 5 /sd 03/01/2001 /tn \"My App\" /tr c:\\apps\\myapp.exe\r\nschtasks create daily\r\nSyntax\r\nschtasks /create /tn TaskName /tr TaskRun /sc daily [/mo {1 -\r\n365}] [/st StartTime] [/sd StartDate] [/ed EndDate] [/s computer [/u [domain\\]user /p password]] [/ru {[Domain\\]User |\r\n\"System\"} [/rp Password]] \r\nExample\r\nTo schedule a task that runs every day\r\nThe following example schedules the MyApp program to run once a day, every day, at 8:00 A.M. until December 31, 2001.\r\nBecause it omits the /mo parameter, the default interval of 1 is used to run the command every day.\r\nschtasks /create /tn \"My App\" /tr c:\\apps\\myapp.exe /sc daily /st 08:00:00 /ed 12/31/2001\r\nTo schedule a task that runs every other day\r\nThe following example schedules the MyApp program to run every other day at 1:00 P.M. (13:00) beginning on\r\nDecember 31, 2001. The command uses the /mo parameter to specify an interval of two (2) days.\r\nschtasks /create /tn \"My App\" /tr c:\\apps\\myapp.exe /sc daily /mo 2 /st 13:00:00 /sd 12/31/2001\r\nschtasks create weekly\r\nSyntax\r\nschtasks /create /tn TaskName /tr TaskRun /sc weekly [/d {MON - SUN | *}] [/mo {1 -\r\n52}] [/st StartTime] [/sd StartDate] [/ed EndDate] [/s computer [/u [domain\\]user /p password]] [/ru {[Domain\\]User |\r\nhttps://technet.microsoft.com/en-us/library/bb490996.aspx\r\nPage 4 of 15\n\n\"System\"} [/rp Password]] \r\nExample\r\nTo schedule a task that runs every six weeks\r\nThe following command schedules the MyApp program to run on a remote computer every six weeks. The command uses\r\nthe /mo parameter to specify the interval. It also uses the /s parameter to specify the remote computer and the /ru parameter\r\nto schedule the task to run with the permissions of the user's Administrator account. Because the /rp parameter is omitted,\r\nSchTasks.exe prompts the user for the Administrator account password.\r\nAlso, because the command is run remotely, all paths in the command, including the path to MyApp.exe, refer to paths on\r\nthe remote computer.\r\nschtasks /create /tn \"My App\" /tr c:\\apps\\myapp.exe /sc weekly /mo 6 /s Server16 /ru Admin01\r\nTo schedule a task that runs every other week on Friday\r\nThe following command schedules a task to run every other Friday. It uses the /mo parameter to specify the two-week\r\ninterval and the /d parameter to specify the day of the week. To schedule a task that runs every Friday, omit the /mo\r\nparameter or set it to 1.\r\nschtasks /create /tn \"My App\" /tr c:\\apps\\myapp.exe /sc weekly /mo 2 /d FRI\r\nschtasks create monthly\r\nSyntax\r\nGeneral Monthly Schedule Syntax : schtasks /create /tn TaskName /tr TaskRun /sc monthly [/mo {FIRST | SECOND |\r\nTHIRD | FOURTH | LAST | LASTDAY] [/d {MON - SUN | 1 - 31}] [/m {JAN - DEC[,JAN - DEC...] |\r\n*}] [/st StartTime] [/sd StartDate] [/ed EndDate] [/s computer [/u [domain\\]user /p password]] [/ru {[Domain\\]User |\r\n\"System\"} [/rp Password]] \r\nSpecific Week Syntax : schtasks /create /tn TaskName /tr TaskRun /sc monthly /mo {FIRST | SECOND | THIRD |\r\nFOURTH | LAST} /d {MON - SUN} [/m {JAN - DEC[,JAN - DEC...] |\r\n*}] [/st StartTime] [/sd StartDate] [/ed EndDate] [/s computer [/u [domain\\]user /p password]] [/ru {[Domain\\]User |\r\n\"System\"} [/rp Password]] \r\nLastday Syntax : schtasks /create /tn TaskName /tr TaskRun /sc monthly /mo LASTDAY /m {JAN - DEC[,JAN -\r\nDEC...] | *} [/st StartTime] [/sd StartDate] [/ed EndDate] [/s computer [/u [domain\\]user /p password]] [/ru\r\n{[Domain\\]User | \"System\"} [/rp Password]] \r\nSpecific Date Syntax : schtasks /create /tn TaskName /tr TaskRun /sc monthly /d {1 - 31} [/m {JAN - DEC[,JAN -\r\nDEC...] | *}] [/st StartTime] [/sd StartDate] [/ed EndDate] [/s computer [/u [domain\\]user /p password]] [/ru\r\n{[Domain\\]User | \"System\"} [/rp Password]] \r\nExamples\r\nTo schedule a task for the first day of every month\r\nThe following command schedules the MyApp program to run on the first day of every month. Because the default modifier\r\nis none (no modifier), the default day is day 1, and the default month is every month, the command does not need any\r\nadditional parameters.\r\nschtasks /create /tn \"My App\" /tr c:\\apps\\myapp.exe /sc monthly\r\nTo schedule a task for the last day of every month\r\nThe following command schedules the MyApp program to run on the last day of every month. It uses the /mo parameter to\r\nspecify the last day of the month and the /m parameter with the wildcard character (*) to indicate that the program runs on\r\nthe last day of every month.\r\nschtasks /create /tn \"My App\" /tr c:\\apps\\myapp.exe /sc monthly /mo lastday /m *\r\nTo schedule a task that runs every three months\r\nThe following command schedules the MyApp program to run every three months. It uses the /mo parameter to specify the\r\ninterval.\r\nhttps://technet.microsoft.com/en-us/library/bb490996.aspx\r\nPage 5 of 15\n\nschtasks /create /tn \"My App\" /tr c:\\apps\\myapp.exe /sc monthly /mo 3\r\nTo schedule a task for the second Sunday of every month\r\nThe following command schedules the MyApp program to run on the second Sunday of every month. It uses the /mo\r\nparameter to specify the second week of the month and the /d parameter to specify the day.\r\nschtasks /create /tn \"My App\" /tr c:\\apps\\myapp.exe /sc monthly /mo SECOND /d SUN\r\nTo schedule a task for the 15th days of May and June\r\nThe following command schedules the MyApp program to run on May 15 and June 15 at 3:00 PM (15:00). It uses the /d\r\nparameter to specify the date and the /m parameter to specify the months. It also uses the /st parameter to specify the start\r\ntime.\r\nschtasks /create /tn \"My App\" /tr c:\\apps\\myapp.exe /sc monthly /d 15 /m MAY,JUN /st 15:00:00\r\nschtasks create once\r\nSyntax\r\nschtasks /create /tn TaskName /tr TaskRun /sc once /st StartTime /sd StartDate [/s computer [/u\r\n[domain\\]user /p password]] [/ru {[Domain\\]User | \"System\"} [/rp Password]] \r\nExample\r\nTo schedule a task that runs one time\r\nThe following command schedules the MyApp program to run at midnight on January 1, 2002. It uses the /ru parameter to\r\nrun the task with the permissions of the user's Administrator account and the /rp parameter to provide the password for the\r\nAdministrator account.\r\nschtasks /create /tn \"My App\" /tr c:\\apps\\myapp.exe /sc once /st 00:00:00 /sd 01/01/2002 /ru Admin23 /rp p@ssworD1\r\nschtasks create onstart\r\nSyntax\r\nschtasks /create /tn TaskName /tr TaskRun /sc onstart [/sd StartDate] [/s computer [/u [domain\\]user /p password]] [/ru\r\n{[Domain\\]User | \"System\"} [/rp Password]] \r\nExample\r\nTo schedule a task that runs every time the system starts\r\nThe following command schedules the MyApp program to run every time the system starts, beginning on March 15, 2001:\r\nschtasks /create /tn \"My App\" /tr c:\\apps\\myapp.exe /sc onstart /sd 03/15/2001\r\nschtasks create onlogon\r\nSyntax\r\nschtasks /create /tn TaskName /tr TaskRun /sc onlogon [/sd StartDate] [/s computer [/u [domain\\]user /p password]] [/ru\r\n{[Domain\\]User | \"System\"} [/rp Password]] \r\nExample\r\nTo schedule a task that runs when a user logs on to a remote computer\r\nThe following command schedules a batch file to run every time a user (any user) logs on to the remote computer. It uses the\r\n/s parameter to specify the remote computer. Because the command is remote, all paths in the command, including the path\r\nto the batch file, refer to a path on the remote computer.\r\nschtasks /create /tn \"Start Web Site\" /tr c:\\myiis\\webstart.bat /sc onlogon /s Server23\r\nschtasks create onidle\r\nSyntax\r\nhttps://technet.microsoft.com/en-us/library/bb490996.aspx\r\nPage 6 of 15\n\nschtasks /create /tn TaskName /tr TaskRun /sc onidle /iIdleTime [/sd StartDate] [/s computer [/u\r\n[domain\\]user /p password]] [/ru {[Domain\\]User | \"System\"} [/rp Password]] \r\nExample\r\nTo schedule a task that runs whenever the computer is idle\r\nThe following command schedules the MyApp program to run whenever the computer is idle. It uses the required /i\r\nparameter to specify that the computer must remain idle for ten minutes before the task starts.\r\nschtasks /create /tn \"My App\" /tr c:\\apps\\myapp.exe /sc onidle /i 10\r\nMore examples\r\nTo view the example, click the example name:\r\nTo create a task that runs with System permissions\r\nThe following command schedules the MyApp program to run with permissions of the NT Authority\\System account. In this\r\nexample, the task is scheduled to run on the first day of every month, but you can use any schedule type for a task run with\r\nsystem permissions.\r\nThe command uses the /ru \"System\" parameter to specify the system security context. Because system tasks do not use a\r\npassword, the /rp parameter is omitted.\r\nschtasks /create /tn \"My App\" /tr c:\\apps\\myapp.exe /sc monthly /d 1 /ru \"System\"\r\nIn response, SchTasks.exe displays an informational message and a success message. It does not prompt for a password.\r\nINFO: The task will be created under user name (\"NT AUTHORITY\\SYSTEM\").\r\nSUCCESS: The Scheduled task \"My App\" has successfully been created.\r\nTo create a task that runs more than one program\r\nEach task runs only one program. However, you can create a batch file that runs multiple programs and then schedule a task\r\nto run the batch file. The following procedure demonstrates this method:\r\n1. Create a batch file that starts the programs you want to run.\r\nIn this example, you create a batch file that starts Event Viewer (Eventvwr.exe) and System Monitor (Perfmon.exe).\r\nOpen a text editor, such as Notepad.\r\nType the name and fully qualified path to the executable file for each program. In this case, the file includes\r\nthe following statements.\r\nC:\\Windows\\System32\\Eventvwr.exe\r\nC:\\Windows\\System32\\Perfmon.exe\r\nSave the file as MyApps.bat.\r\n2. Use SchTasks.exe to create a task that runs MyApps.bat.\r\nThe following command creates the Monitor task, which runs whenever anyone logs on. It uses the /tn parameter to\r\nname the task, and the /tr parameter to run MyApps.bat. It uses the /sc parameter to indicate the OnLogon schedule\r\ntype and the /ru parameter to specify the Administrator account.\r\nschtasks /create /tn Monitor /tr C:\\MyApps.bat /sc onlogon /ru Reskit\\Administrator\r\nAs a result of this command, whenever a user logs on to the computer, the task starts both Event Viewer and System\r\nMonitor.\r\nschtasks change\r\nChanges one or more of the following properties of a task.\r\nThe program that the task runs (/tr).\r\nThe user account under which the task runs (/ru).\r\nThe password for the user account (/rp).\r\nhttps://technet.microsoft.com/en-us/library/bb490996.aspx\r\nPage 7 of 15\n\nSyntax\r\nschtasks /change /tn TaskName [/s computer [/u [domain\\]user /p password]] [/tr TaskRun] [/ru [Domain\\]User |\r\n\"System\"] [/rp Password]\r\nParameters\r\n/tn   TaskName   : Identifies the task to be changed. Enter the task name.\r\n/s   Computer   : Specifies the name or IP address of a remote computer (with or without backslashes). The default is the\r\nlocal computer.\r\n/u [ domain \\] user   : Runs the command with the permissions of the specified user account. By default, the command runs\r\nwith the permissions of the user logged on to the computer running SchTasks.\r\n/p   password   : Specifies the password of the user account specified in the /u parameter. This parameter is required when\r\nthe /u parameter is used.\r\n/tr   TaskRun   : Changes the program that the task runs. Enter the fully qualified path and file name of an executable file,\r\nscript file, or batch file. If you omit the path, SchTasks.exe assumes that the file is in the Systemroot\\System32 directory. The\r\nspecified program replaces the original program run by the task.\r\n/ru [ Domain \\] User | \"System\"   : Changes the user account for the task.\r\nValue Description\r\n[Domain\\]User Specifies a user account.\r\n\"System\" or \"\" Specifies the NT Authority\\System account, which is used by the operating system.\r\nWhen you change the user account, you must also change the user password. If a command has an /ru parameter but not an\r\n/rp parameter, SchTasks.exe prompts for a new password and obscures the text you type.\r\nTasks run with with permissions of the NT Authority\\System account do not require a password and SchTasks.exe does not\r\nprompt for one.\r\n/rp   Password   : Changes the account password for the task. Enter the new password.\r\n/? : Displays help at the command prompt.\r\nUsing the /s, /u, and /p command-line options\r\nThe /u and /p command-line options are available only when you use /s. You must use /p with /u to provide the user's\r\npassword.\r\nThe /tn and /s parameters identify the task. The /tr, /ru, and /rp parameters specify properties of the task that you can\r\nchange.\r\nA command that uses the change operation must change at least one task property.\r\nThe NT Authority\\System account does not have interactive logon rights. Users do not see and cannot interact with\r\nprograms run with system permissions.\r\nExamples\r\nTo change the program that a task runs\r\nThe following command changes the program that the Virus Check task runs from VirusCheck.exe to VirusCheck2.exe. This\r\ncommand uses the /tn parameter to identify the task and the /tr parameter to specify the new program for the task. (You\r\ncannot change the task name.)\r\nschtasks /change /tn \"Virus Check\" /tr C:\\VirusCheck2.exe\r\nIn response, SchTasks.exe displays the following success message:\r\nhttps://technet.microsoft.com/en-us/library/bb490996.aspx\r\nPage 8 of 15\n\nSUCCESS: The parameter of the Scheduled Task \"Virus Check\" has been changed.\r\nAs a result of this command, the Virus Check task now runs VirusCheck2.exe.\r\nTo change the password for a remote task\r\nThe following command changes the password of the user account for the RemindMe task on the remote computer, Svr01.\r\nThe command uses the /tn parameter to identify the task and the /s parameter to specify the remote computer. It uses the /rp\r\nparameter to specify the new password, p@ssWord3.\r\nThis procedure is required whenever the password for a user account expires or changes. If the password saved in a task is\r\nno longer valid, then the task does not run.\r\nschtasks /change /tn RemindMe /s Svr01 /rp p@ssWord3\r\nIn response, SchTasks.exe displays the following success message:\r\nSUCCESS: The parameter of the Scheduled Task \"RemindMe\" has been changed.\r\nAs a result of this command, the RemindMe task now runs under its original user account, but with a new password.\r\nTo change the program and user account for a task\r\nThe following command changes the program that a task runs and changes the user account under which the task runs.\r\nEssentially, it uses an old schedule for a new task. This command changes the Notepad task, which starts Notepad.exe every\r\nmorning at 9:00 a.m., to start Internet Explorer instead.\r\nThe command uses the /tn parameter to identify the task. It uses the /tr parameter to change the program that the task runs\r\nand the /ru parameter to change the user account under which the task runs.\r\nThe /rp parameter, which provides the password for the user account, is omitted. You must provide a password for the\r\naccount, but you can use the /rp parameter and type the password in clear text, or wait for SchTasks.exe to prompt you for a\r\npassword, and then enter the password in obscured text.\r\nschtasks /change /tn Notepad /tr \"c:\\program files\\Internet Explorer\\iexplore.exe\" /ru DomainX\\Admin01\r\nIn response, SchTasks.exe requests the password for the user account. It obscures the text you type, so the password is not\r\nvisible.\r\nPlease enter the password for DomainX\\Admin01: *********\r\nNote that the /tn parameter identifies the task and that the /tr and /ru parameters change the properties of the task. You\r\ncannot use another parameter to identify the task and you cannot change the task name.\r\nIn response, SchTasks.exe displays the following success message:\r\nSUCCESS: The parameter of the Scheduled Task \"Notepad\" has been changed.\r\nAs a result of this command, the RemindMe task now runs under its original user account, but with a new password.\r\nTo change a program to the System account\r\nThe following command changes the SecurityScript task so that it runs with permissions of the NT Authority\\System\r\naccount. It uses the /ru \"\" parameter to indicate the System account.\r\nschtasks /change /tn SecurityScript /ru \"\"\r\nIn response, SchTasks.exe displays the following success message:\r\nSUCCESS: The parameter of the Scheduled Task \"SecurityScript\" has been changed.\r\nBecause tasks run with System account permissions do not require a password, SchTasks.exe does not prompt for one.\r\nschtasks run\r\nhttps://technet.microsoft.com/en-us/library/bb490996.aspx\r\nPage 9 of 15\n\nStarts a scheduled task immediately. The run operation ignores the schedule, but uses the program file location, user\r\naccount, and password saved in the task to run the task immediately.\r\nSyntax\r\nschtasks /run /tn TaskName [/s computer [/u [domain\\]user /p password]] /? \r\nParameters\r\n/tn   TaskName   : Identifies the task. This parameter is required.\r\n/s   Computer   : Specifies the name or IP address of a remote computer (with or without backslashes). The default is the\r\nlocal computer.\r\n/u [ domain \\] user   : Runs the command with the permissions of the specified user account. By default, the command runs\r\nwith the permissions of the user logged on to the computer running SchTasks.\r\n/p   password   : Specifies the password of the user account specified in the /u parameter. This parameter is required when\r\nthe /u parameter is used.\r\n/? : Displays help at the command prompt.\r\nUsing the /s, /u, and /p command-line options\r\nThe /u and /p command-line options are available only when you use /s. You must use /p with /u to provide the user's\r\npassword.\r\nUse this operation to test your tasks. If a task does not run, check the Task Scheduler Service transaction log,\r\nSystemroot\\SchedLgU.txt, for errors.\r\nRunning a task does not affect the task schedule and does not change the next run time scheduled for the task.\r\nTo run a task remotely, the task must be scheduled on the remote computer. When you run it, the task runs only on\r\nthe remote computer. To verify that a task is running on a remote computer, use Task Manager or the Task Scheduler\r\ntransaction log, Systemroot\\SchedLgU.txt.\r\nExamples\r\nTo run a task on the local computer\r\nThe following command starts the \"Security Script\" task.\r\nschtasks /run /tn \"Security Script\"\r\nIn response, SchTasks.exe starts the script associated with the task and displays the following message:\r\nSUCCESS: The Scheduled Task \"Security Script\" is running ......\r\nTo run a task on a remote computer\r\nThe following command starts the Update task on a remote computer, Svr01:\r\nschtasks /run /tn Update /s Svr01\r\nIn this case, SchTasks.exe displays the following error message:\r\nERROR: Unable to run the Scheduled Task \"Update\".\r\nTo find the cause of the error, look in the Scheduled Tasks transaction log, C:\\Windows\\SchedLgU.txt on Svr01. In this case,\r\nthe following entry appears in the log:\r\n\"Update.job\" (update.exe) 3/26/2001 1:15:46 PM ** ERROR **\r\nThe attempt to log on to the account associated with the task failed, therefore, the task did not run.\r\nThe specific error is:\r\n0x8007052e: Logon failure: unknown user name or bad password.\r\nVerify that the task's Run-as name and password are valid and try again.\r\nhttps://technet.microsoft.com/en-us/library/bb490996.aspx\r\nPage 10 of 15\n\nApparently, the user name or password in the task is not valid on the system. The following schtasks /change command\r\nupdates the user name and password for the Update task on Svr01:\r\nschtasks /change /tn Update /s Svr01 /ru Administrator /rp PassW@rd3\r\nAfter the change command completes, the run command is repeated. This time, the Update.exe program starts and\r\nSchTasks.exe displays the following message:\r\nSUCCESS: The Scheduled Task \"Update\" is running......\r\nschtasks end\r\nStops a program started by a task.\r\nSyntax\r\nschtasks /end /tn TaskName [/s computer [/u [domain\\]user /p password]] /? \r\nParameters\r\n/tn   TaskName   : Identifies the task that started the program. This parameter is required.\r\n/s   Computer   : Specifies the name or IP address of a remote computer (with or without backslashes). The default is the\r\nlocal computer.\r\n/u [ domain \\] user   : Runs the command with the permissions of the specified user account. By default, the command runs\r\nwith the permissions of the user logged on to the computer running SchTasks.\r\n/p   password   : Specifies the password of the user account specified in the /u parameter. This parameter is required when\r\nthe /u parameter is used.\r\n/?   : Displays help.\r\nUsing the /s, /u, and /p command-line options\r\nThe /u and /p command-line options are available only when you use /s. You must use /p with /u to provide the user's\r\npassword.\r\nSchTasks.exe ends only the instances of a program started by a scheduled task. To stop other processes, use TaskKill,\r\na tool included in Windows XP Professional. For more information about TaskKill, see Taskkill.\r\nExamples\r\nTo end a task on a local computer\r\nThe following command stops the instance of Notepad.exe that was started by the My Notepad task:\r\nschtasks /end /tn \"My Notepad\"\r\nIn response, SchTasks.exe stops the instance of Notepad.exe that the task started, and it displays the following success\r\nmessage:\r\nSUCCESS: The Scheduled Task \"My Notepad\" has been terminated successfully.\r\nTo end a task on a remote computer\r\nThe following command stops the instance of Internet Explorer that was started by the InternetOn task on the remote\r\ncomputer, Svr01:\r\nschtasks /end /tn InternetOn /s Svr01\r\nIn response, SchTasks.exe stops the instance of Internet Explorer that the task started, and it displays the following success\r\nmessage:\r\nSUCCESS: The Scheduled Task \"InternetOn\" has been terminated successfully.\r\nschtasks delete\r\nhttps://technet.microsoft.com/en-us/library/bb490996.aspx\r\nPage 11 of 15\n\nDeletes a scheduled task.\r\nSyntax\r\nschtasks /delete /tn {TaskName | *} [/f] [/s computer [/u [domain\\]user /p password]] [/?]\r\nParameters\r\n/tn { TaskName | *} : Identifies the task being deleted. This parameter is required.\r\nValue Description\r\nTaskName Deletes the named task.\r\n* Deletes all scheduled tasks on the computer.\r\n/f   : Suppresses the confirmation message. The task is deleted without warning.\r\n/s   Computer   : Specifies the name or IP address of a remote computer (with or without backslashes). The default is the\r\nlocal computer.\r\n/u [ domain \\] user   : Runs the command with the permissions of the specified user account. By default, the command runs\r\nwith the permissions of the user logged on to the computer running SchTasks.\r\n/p   password   : Specifies the password of the user account specified in the /u parameter. This parameter is required when\r\nthe /u parameter is used.\r\n/? : Displays help at the command prompt.\r\nUsing the /s, /u, and /p command-line options\r\nThe /u and /p command-line options are available only when you use /s. You must use /p with /u to provide the user's\r\npassword.\r\nThe delete operation deletes the task from the schedule. It does not delete the program that the task runs or interrupt a\r\nrunning program.\r\nThe delete * command deletes all tasks scheduled for the computer, not just the tasks scheduled by the current user.\r\nExamples\r\nTo delete a task from the schedule of a remote computer\r\nThe following command deletes the \"Start Mail\" task from the schedule of a remote computer. It uses the /s parameter to\r\nidentify the remote computer.\r\nschtasks /delete /tn \"Start Mail\" /s Svr16\r\nIn response, SchTasks.exe displays the following confirmation message. To delete the task, type y. To cancel the command,\r\ntype n:\r\nWARNING: Are you sure you want to remove the task \"Start Mail\" (Y/N )? y\r\nSUCCESS: The Scheduled Task \"Start Mail\" was successfully deleted.\r\nTo delete all tasks scheduled for the local computer\r\nThe following command deletes all tasks from the schedule of the local computer, including tasks scheduled by other users.\r\nIt uses the /tn * parameter to represent all tasks on the computer and the /f parameter to suppress the confirmation message.\r\nschtasks /delete /tn * /f\r\nIn response, SchTasks.exe displays the following success messages indicating that the only task scheduled, SecureScript, is\r\ndeleted.\r\nSUCCESS: The Scheduled Task \"SecureScript\" was successfully deleted. \r\nhttps://technet.microsoft.com/en-us/library/bb490996.aspx\r\nPage 12 of 15\n\nschtasks query\r\nDisplays all tasks scheduled to run on the computer, including those scheduled by other users.\r\nSyntax\r\nschtasks [/query] [/fo {TABLE | LIST | CSV}] [/nh] [/v] [/s computer [/u [domain\\]user /p password]] \r\nParameters\r\n[ /query ] : The operation name is optional. Typing schtasks without any parameters performs a query.\r\n/fo { TABLE | LIST | CSV } : Specifies the output format. TABLE is the default.\r\n/nh   : Omits column headings from the table display. This parameter is valid with the TABLE and CSV output formats.\r\n/v   : Adds advanced properties of the tasks to the display.\r\nQueries using /v should be formatted as LIST or CSV.\r\n/s   Computer   : Specifies the name or IP address of a remote computer (with or without backslashes). The default is the\r\nlocal computer.\r\n/u [ domain \\] user   : Runs the command with the permissions of the specified user account. By default, the command runs\r\nwith the permissions of the user logged on to the computer running SchTasks.\r\n/p   password   : Specifies the password of the user account specified in the /u parameter. This parameter is required when\r\nthe /u parameter is used.\r\n/? : Displays help at the command prompt.\r\nUsing the /s, /u, and /p command-line options\r\nThe /u and /p command-line options are available only when you use /s. You must use /p with /u to provide the user's\r\npassword.\r\nThe query operation lists all tasks scheduled for the computer, not just the tasks scheduled by the current user.\r\nExamples\r\nTo display the scheduled tasks on the local computer\r\nThe following commands display all tasks scheduled for the local computer. These commands produce the same result and\r\ncan be used interchangeably.\r\nschtasks\r\nschtasks /query\r\nIn response, SchTasks.exe displays the tasks in the default, siple table format, as shown in the following table:\r\nTaskName Next Run Time Status\r\n========================= ======================== ==============\r\nMicrosoft Outlook At logon time\r\nSecureScript 14:42:00 PM , 2/4/2001\r\nTo display advanced properties scheduled tasks\r\nThe following command requests a detailed display of the tasks on the local computer. It uses the /v parameter to request a\r\ndetailed (verbose) display and the /fo LIST parameter to format the display as a list for easy reading. You can use this\r\ncommand to verify that a task you created has the intended recurrence pattern.\r\nschtasks /query /fo LIST /v\r\nIn response, SchTasks.exe displays a detailed property list for all tasks. The following display shows the task list for a task\r\nscheduled to run at 4:00 A.M. on the last Friday of every month:\r\nHostName: RESKIT01\r\nTaskName: SecureScript\r\nNext Run Time: 4:00:00 AM , 3/30/2001\r\nhttps://technet.microsoft.com/en-us/library/bb490996.aspx\r\nPage 13 of 15\n\nStatus: Not yet run\r\nLast Run Time: Never\r\nLast Result: 0\r\nCreator: user01\r\nSchedule: At 4:00 AM on the last Fri of every month, starting 3/24/2001\r\nTask To Run: C:\\WINDOWS\\system32\\notepad.exe\r\nStart In: notepad.exe\r\nComment: N/A\r\nScheduled Task State: Enabled\r\nScheduled Type: Monthly\r\nModifier: Last FRIDAY\r\nStart Time: 4:00:00 AM\r\nStart Date: 3/24/2001\r\nEnd Date: N/A\r\nDays: FRIDAY\r\nMonths: JAN,FEB,MAR,APR,MAY,JUN,JUL,AUG,SEP,OCT,NOV,DEC\r\nRun As User: RESKIT\\user01\r\nDelete Task If Not Rescheduled: Enabled\r\nStop Task If Runs X Hours and X Mins: 72:0\r\nRepeat: Until Time: Disabled\r\nRepeat: Duration: Disabled\r\nRepeat: Stop If Still Running: Disabled\r\nIdle: Start Time(For IDLE Scheduled Type): Disabled\r\nIdle: Only Start If Idle for X Minutes: Disabled\r\nIdle: If Not Idle Retry For X Minutes: Disabled\r\nIdle: Stop Task If Idle State End: Disabled\r\nPower Mgmt: No Start On Batteries: Disabled\r\nPower Mgmt: Stop On Battery Mode: Disabled\r\nTo log tasks scheduled for a remote computer\r\nThe following command requests a list of tasks scheduled for a remote computer, and adds the tasks to a comma-separated\r\nlog file on the local computer. You can use this command format to collect and track tasks that are scheduled for multiple\r\ncomputers.\r\nThe command uses the /s parameter to identify the remote computer, Reskit16, the /fo parameter to specify the format and\r\nthe /nh parameter to suppress the column headings. The \u003e\u003e append symbol redirects the output to the task log, p0102.csv, on\r\nthe local computer, Svr01. Because the command runs on the remote computer, the local computer path must be fully\r\nqualified.\r\nschtasks /query /s Reskit16 /fo csv /nh \u003e\u003e \\\\svr01\\data\\tasklogs\\p0102.csv\r\nIn response, SchTasks.exe adds the tasks scheduled for the Reskit16 computer to the p0102.csv file on the local computer,\r\nSvr01.\r\nSchTasks.exe performs operations similar to those in Scheduled Tasks in Control Panel. You can use either tool to\r\ncreate, delete, configure, or display scheduled tasks.\r\nTyping schtasks without any parameters performs a query.\r\nThe user must be a member of the Administrators group on the computer that the command affects.\r\nTo verify that a scheduled task ran or to find out why a scheduled task did not run, see the Task Scheduler service\r\ntransaction log, Systemroot\\SchedLgU.txt. This log records attempted runs initiated by all tools that use the service,\r\nincluding Scheduled Tasks and SchTasks.exe.\r\nOn rare occasions, task files become corrupted. Corrupted tasks do not run. When you try to perform an operation on\r\ncorrupted tasks, SchTasks.exe displays the following error message:\r\nERROR: The data is invalid.\r\nYou cannot recover corrupted tasks. To restore the task scheduling features of the system, use SchTasks.exe or\r\nScheduled Tasks to delete the tasks from the system and reschedule them.\r\nSchTasks.exe replaces At.exe, a tool included in previous versions of Windows.\r\nFormatting legend\r\nhttps://technet.microsoft.com/en-us/library/bb490996.aspx\r\nPage 14 of 15\n\nFormat Meaning\r\nItalic Information that the user must supply\r\nBold Elements that the user must type exactly as shown\r\nEllipsis (...)\r\nParameter that can be repeated several times in a\r\ncommand line\r\nBetween brackets ([]) Optional items\r\nBetween braces ({}); choices separated by pipe (|). Example:\r\n{even|odd}\r\nSet of choices from which the user must choose only\r\none\r\nCourier font Code or program output\r\nCommand-line reference A-Z\r\nTaskkill\r\nSource: https://technet.microsoft.com/en-us/library/bb490996.aspx\r\nhttps://technet.microsoft.com/en-us/library/bb490996.aspx\r\nPage 15 of 15",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://technet.microsoft.com/en-us/library/bb490996.aspx"
	],
	"report_names": [
		"bb490996.aspx"
	],
	"threat_actors": [
		{
			"id": "2864e40a-f233-4618-ac61-b03760a41cbb",
			"created_at": "2023-12-01T02:02:34.272108Z",
			"updated_at": "2026-04-10T02:00:04.97558Z",
			"deleted_at": null,
			"main_name": "WildCard",
			"aliases": [],
			"source_name": "ETDA:WildCard",
			"tools": [
				"RustDown",
				"SysJoker"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "256a6a2d-e8a2-4497-b399-628a7fad4b3e",
			"created_at": "2023-11-30T02:00:07.299845Z",
			"updated_at": "2026-04-10T02:00:03.484788Z",
			"deleted_at": null,
			"main_name": "WildCard",
			"aliases": [],
			"source_name": "MISPGALAXY:WildCard",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434446,
	"ts_updated_at": 1775792121,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/ca1accaed106f3da0eee879d4650bcba62561e20.pdf",
		"text": "https://archive.orkl.eu/ca1accaed106f3da0eee879d4650bcba62561e20.txt",
		"img": "https://archive.orkl.eu/ca1accaed106f3da0eee879d4650bcba62561e20.jpg"
	}
}