Report to show scheduled tasks on a pc

[kcovingt]

Is it possible to create a report that shows all scheduled tasks on a particular pc? We have a particular virus that is creating scheduled tasks on pc's to reinfect them and cause other malicious code to be executed and it would extremely helpful to us if this is possible to show in a report. I tried looking through the different tables but could not find the exact variable I was looking for.

On a side note, is there any documentation that lists all the table variables and what each stand for? I looked through the normal documentation but could find nothing about all the variables in each table.

[Hemoco]

Scanning of scheduled tasks has not been added, as this information cannot be accurately retrieved from WMI. A technical explanation can be found here.

[bgrr]

Any news if report of scheduled tasks is already implemented ?

[taeratrin]

From what I can tell, this has not yet been implemented.

[Hemoco]

taeratrin wrote:
From what I can tell, this has not yet been implemented.

This is not implemented in version 4.0

[MajorWoody]

Lansweeper wrote:

taeratrin wrote:
From what I can tell, this has not yet been implemented.

This is not implemented in version 4.0

Is this still planned in a future release?


Thanks,
Major

[sndrrlyng]

I now have Lansweeper 4 - how do I list scheduled tasks on machines as indicated would be implemented in version 4?

Thanks

[Anonymous]

kcovingt wrote:
Is it possible to create a report that shows all scheduled tasks on a particular pc? We have a particular virus that is creating scheduled tasks on pc's to reinfect them and cause other malicious code to be executed and it would extremely helpful to us if this is possible to show in a report. I tried looking through the different tables but could not find the exact variable I was looking for.

You can easily do that like this:
1. create a file with the hostnames, and give it a name hostnames.txt like this:

hostname1
hostname2
hostnameX

2. create a batch file with:

FOR /F %%a in (hostnames.txt) Do schtasks.exe /query /fo list /s %%a /v

3. execute the batch file, it will scan scheduled tasks on the hostnames pointed in hostnames.txt

if you change the parameter /fo you can have several other formats, use Schtasks.exe /query /? to check available formats.

Regards,
Paulo

[kcovingt]

Thanks for the reply and the link. Sounds like version 4 will be worth the wait and we look forward to using it when it becomes available.

[Hemoco]

kcovingt wrote:
Is it possible to create a report that shows all scheduled tasks on a particular pc?

This is not implemented in the current version (will be in 4.0)

On a side note, is there any documentation that lists all the table variables and what each stand for? I looked through the normal documentation but could find nothing about all the variables in each table.

All tables map to the corresponding win32 wmi classes.

tbloperatingsystem maps to win32_operatingsystem

http://msdn.microsoft.com/en-us/library/aa394239%28VS.85%29.aspx