Skip to content

Glossary

TaskCache

The registry key in the SOFTWARE hive where the Task Scheduler service keeps its copy of every registered task: Tree, Tasks and category subkeys.

TaskCache is HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache. Its Tree subkey has one key per task path, with the task GUID (Id), a category (Index) and a security descriptor (SD). Its Tasks\{GUID} subkeys hold the task data: path, author, date, hash, binary actions and triggers, and DynamicInfo run times. Boot, Logon, Plain and Maintenance list task GUIDs by category (cyber.wtf).

A task can survive in TaskCache after its XML file is deleted, which makes the key essential in an investigation. See TaskCache registry forensics.