Skip to content

Glossary

schtasks.exe

The built-in Windows command-line tool to create, query, change, run and delete scheduled tasks, the replacement for the deprecated at.exe.

schtasks.exe talks to the Task Scheduler service: /create, /query, /change, /run, /end and /delete (Microsoft Learn). Tasks it creates get an Author of the creating account and a zoneless local Date in their XML.

For investigators, two limits matter. It only lists tasks the service will show, so hidden tasks with a missing or restrictive security descriptor do not appear; and its presence in process execution evidence is common in both administration and intrusions. See Tarrask and hidden scheduled tasks.