Event submitted by Event Log Doctor
Event ID:
602
Source:
Security

Message:
Scheduled Task created:
File Name: C:\WINDOWS\Tasks\Calculator.job
Command: C:\WINDOWS\system32\calc.exe
Triggers: At 11:48 AM every day, starting 11/14/2006.
Time: 11/14/2006 11:48:00 AM
Flags: 0x18000C0
Target User: EVENTSENTRY\User1
By:
User: User1
Domain: EVENTSENTRY
Logon ID: (0x0,0x127F30A0)







Solution by Event Log Doctor

2006-11-14 13:11:09 UTC

This event is logged on Windows Server 2003 when a scheduled task is being started.

The additional information in the event tells you when the scheduled task executes, "Target User" is the user that the job will run under.

You can use the logon id to link this event back to a logon session (event id 528 or 540).

You can use EventSentry's recurring event feature to get an alert when the scheduled task does NOT run.

Additionally, you can enable process tracking to see when processes from the scheduled task are executed and exit (event id 592 and 593).



User Information
 
Only an Email address is required for returning users.

Hide Name

Solution

Additional Links