602SecurityScheduled Task created:
File Name: C:\WINDOWS\Tasks\Calculator.job
Command: C:\WINDOWS\system32\calc.exe
Triggers: At 11:48 AM every day, starting 11/14/2006.
Time: 11/14/2006 11:48:00 AM
Flags: 0x18000C0
Target User: EVENTSENTRY\User1
By:
User: User1
Domain: EVENTSENTRY
Logon ID: (0x0,0x127F30A0)
This event is logged on Windows Server 2003 when a scheduled task is being started.
The additional information in the event tells you when the scheduled task executes, "Target User" is the user that the job will run under.
You can use the logon id to link this event back to a logon session (event id 528 or 540).
You can use EventSentry's recurring event feature to get an alert when the scheduled task does NOT run.
Additionally, you can enable process tracking to see when processes from the scheduled task are executed and exit (event id 592 and 593).