SCHTASKS

(from Schedule Tasks)

Allows the administrator to create, delete, search, modify, run, and end scheduled tasks on a local or remote system.

SCHTASKS /parameter [arguments]

Where, instead of parameter:

  • /CREATE - Creates a new scheduled task.
  • /DELETE - Deletes scheduled tasks.
  • /QUERY - Queries scheduled tasks.
  • /CHANGE - Changes a scheduled task.
  • /RUN - Runs a scheduled task on demand.
  • /END - Stops the scheduled task from running.
  • /SHOWSID - View the security identifier (SID) corresponding to a scheduled task.

 

Syntax for creating a new scheduled task:

SCHTASKS /CREATE [/S system [/U username [/P [password]]]] [ {/RU username2 | /XML xmlfile} [/RP password2]] /SC schedule [/MO modifier] [/D day] [/M month] [/I idletime] /TN taskname /TR program [/ST starttime] [/RI interval] [ {/ET endtime | /DU duration} [/K] [/V1]] [/SD startdate] [/ED enddate] [/EC channelname] [/IT | /NP] [/Z] [/F] [/RL level] [/DELAY delay] [/HRESULT] [/?]

Where:

  • /S system - Specifies the remote system to connect to. If not specified, the local system will be assumed.
  • /U username - Specifies the user to connect to to create the scheduled task.
  • /P [password] - Specifies the password associated with the user username. If not specified, the user running the command will be prompted for it.
  • /RU username2 - Specifies the user account used to run the task. For the system account, valid values are "", "NT AUTHORITY\SYSTEM", or SYSTEM. For v2 tasks, you can also use "NT AUTHORITY\LOCALSERVICE" and "NT AUTHORITY\NETWORKSERVICE" in addition to the associated SIDs.
  • /RP password2 - Specifies the password for the user under which the task is run. If not specified or if * is entered, the user running the command will be prompted. password2 is ignored for the system account.
  • /SC schedule - Specifies the frequency of the schedule. Instead of schedule:
    • MINUTE - Every minute.
    • HOURLY - Every hour.
    • DAILY - Every day.
    • WEEKLY - Every week.
    • MONTHLY - Every month.
    • ONCE - Only once.
    • ONSTART - On computer start.
    • ONLOGON - When logging in to the user account used to run it.
    • ONIDLE - When the system enters an idle state.
    • ONEVENT - When a specified event occurs.
  • /MO modifier - Defines additional controls on the frequency of the schedule. Instead of modifier you must specify an integer within a certain range whose meaning depends on the schedule type:
    • MINUTE: - 1-1439 minutes.
    • HOURLY - 1-23 hours.
    • DAILY - 1-365 days.
    • WEEKLY - 1-52 weeks.
    • MONTHLY - 1-12, or FIRST, SECOND, THIRD, FOURTH, LAST, LASTDAY.
    • ONCE - No modifiers available.
    • ONSTART - No modifiers available.
    • ONLOGON - No modifiers available.
    • ONIDLE - No modifiers available.
    • ONEVENT - XPath event query string.
    For example, /SC DAILY /MO 2 starts the task every other day instead of daily.
  • /D days - Specify the days of the week (for weekly tasks) or month (for monthly tasks).
    For weekly tasks:
    • MON - Every monday.
    • TUE - Every tuesday.
    • WED - Every wednesday.
    • THU - Every thursday.
    • FRI - Every friday.
    • SAT - Every saturday.
    • SUN - Every sunday.

    For monthly tasks, you can specify a number from 1 to 31 inclusive. The wildcard * indicates all days.
  • /M month - Specify the months of the year for annual tasks:
    • JAN - Every January.
    • FEB - Every February.
    • MAR - Every March.
    • APR - Every April.
    • MAY - Every May.
    • JUN - Every June.
    • JUL - Every July.
    • AUG - Every August.
    • SEP - Every September.
    • OCT - Every October.
    • NOV - Every November.
    • DEC - Every December.

    The wildcard * indicates all months.
  • /I idletime - Specifies the idle time in minutes to wait before running an ONIDLE task. You can specify a number between 1 and 999.
  • /TN taskname - Specifies the unique identifier for the scheduled task as path\name.
  • /TR program - Specifies the path and name of the program to run at the scheduled time.
  • /ST starttime - Specifies the start time of the task execution in the format hh:mm. By default, it uses the current time. This option is required if /SC ONCE is specified.
  • /RI interval - Specifies the repeat interval in minutes. Does not apply to the MINUTE, HOURLY, ONSTART, ONLOGON, ONIDLE, or ONEVENT schedule types. You can specify a number between 1 and 599940. If either /ET or /DU is specified, the default value is 10.
  • /ET endtime - Specifies the end time of the task execution in the hh:mm format. Does not apply to ONSTART, ONLOGON, ONIDLE, or ONEVENT schedule types.
  • /DU duration - Specifies how long the task runs. Does not apply to ONSTART, ONLOGON, ONIDLE, or ONEVENT schedule types.
  • /K - Kills the task once endtime or duration is reached. Does not apply to the ONSTART schedule type.
  • /SD startdate - Specifies the date the task was first run in the dd/mm/yyyy format (depends on locale). By default it uses the current date. Does not apply to the ONCE, ONSTART, ONLOGON, ONIDLE, or ONEVENT schedule types.
  • /ED enddate - Specifies the date after which the task will not be executed anymore in the dd/mm/yyyy format (depends on locale). Does not apply to the ONCE, ONSTART, ONLOGON, ONIDLE, or ONEVENT schedule types.
  • /EC channelname - Specifies the trigger event channel for ONEVENT activities.
  • /IT - Allows the task to run interactively if the user username2 is logged in when the process runs. In this case, the task runs only if the user is logged in.
  • /NP - Specifies not to store any passwords.
  • /Z - Marks the task for deletion after the last run.
  • /XML xmlfile - Creates a task from the specified XML. This option can be combined with the /RU and /RP options, or with /RP alone if the XML already contains the user name for execution.
  • /V1 - Creates a task compatible with platforms prior to Windows Vista. Not compatible with /XML.
  • /F - Forces task creation and ignores warnings if task already exists.
  • /RL level - Sets the execution level, where level is LIMITED or HIGHEST. The default value is LIMITED.
  • /DELAY delay - Specifies the time to wait after the trigger fires in the format mmmm:ss (minutes and seconds). Applies only to the ONSTART, ONLOGON, and ONEVENT schedule types.
  • /HRESULT - Uses the HRESULT format for the process exit code to aid in diagnostics.
  • /? - Displays help for the SCHTASKS /CREATE command.

Examples:

1. Create a scheduled task called Muerte by user luser with password passwrod (yes, he spelled it wrong and doesn't know how to change it) on the remote computer myneighbor which runs shutdown every hour for the user MajorDork with password w3R3b31NgL13d2:

schtasks /create /s myneighbor /u luser /p passwrod /ru MajorDork /rp w3R3b31NgL13d2 /sc hourly /tn Muerte /tr shutdown

2. Create a scheduled task called SaluDOS by user luser with password passwrod on the remote computer myneighbor running cmd every two minutes for user Chad with password 4mR0cKh4Rd on 11/27/2024:

schtasks /create /s myneighbor /u luser /p passwrod /ru Chad /rp 4mR0cKh4Rd /sc minute /mo 2 /tn SaluDOS /tr cmd /sd 27/11/2024 /ed 27/11/2024

 

3. Create a scheduled task called ProcrastinationMode that runs pinball.exe on the second Sunday of every month:

schtasks /create /sc monthly /mo second /d sun /tn ProcrastinationMode /tr pinball.exe

 

4. Create a scheduled task called BullshittingMaNonTroppo that runs pinball.exe every evening at 11:00 PM, terminating the process at 1:00 AM:

schtasks /create /sc daily /tn BullshittingMaNonTroppo /tr pinball.exe /st 23:00 /et 01:00 /k

 

Syntax for deleting one or more scheduled tasks:

SCHTASKS /DELETE [/S system [/U username [/P [password]]]] /TN taskname [/F] [/HRESULT] [/?]

Where:

  • /S system - Specifies the remote system to connect to. If not specified, the local system will be assumed.
  • /U username - Specifies the user to whom the scheduled task you want to delete is associated.
  • /P [password] - Specifies the password associated with the user username. If not specified, the user running the command will be prompted for it.
  • /TN taskname - Specifies the path\name of the scheduled task to delete. The * wildcard indicates that all tasks should be deleted.
  • /F - Force delete the running task and ignore warnings.
  • /HRESULT - Uses the HRESULT format for the process exit code to aid in diagnostics.
  • /? - Displays help for the SCHTASKS /DELETE command.

Examples:

1. Delete the task SaluDOS created by user luser with password passwrod on the remote computer myneighbor:

schtasks /delete /s myneighbor /u luser /p passwrod /tn SaluDOS

 

2. Delete all scheduled tasks including those currently running:

schtasks /delete /tn * /f

 

Syntax for querying scheduled tasks:

SCHTASKS /QUERY [/S system [/U username [/P [password]]]] [/FO format | /XML [ONE]] [/NH] [/V] [/TN taskname] [/HRESULT] [/?]

Where:

  • /S system - Specifies the remote system to connect to. If not specified, the local system will be assumed.
  • /U username - Specifies the user to whom the scheduled tasks you want to query are associated.
  • /P [password] - Specifies the password associated with the user username. If not specified, the user running the command will be prompted for it.
  • /FO format - Specifies the format for the output. format can be:
    • TABLE - table
    • LIST - list
    • CSV - CSV format, i.e. comma-separated values
  • /NH - Specifies to exclude the header from the output. Valid only for TABLE and CSV formats.
  • /V - Enables verbose mode.
  • /TN taskname - Specifies path\name of the scheduled task for which you want to view information. By default, all tasks are displayed.
  • /XML [ONE] - Displays output in XML format. If ONE is specified, the output will be a single valid XML file, otherwise it will simply concatenate the XMLs associated with each activity.
  • /HRESULT - Uses the HRESULT format for the process exit code to aid in diagnostics.
  • /? - Displays help for the SCHTASKS /QUERY command.

Examples:

1. Query all tasks scheduled by user luser with password passwrod on remote computer myneighbor in list format:

schtasks /query /s myneighbor /u luser /p passwrod /fo list

 

2. Query all scheduled tasks in table format, hiding the header and using verbose mode:

schtasks /query /fo table /nh /v

 

Syntax to modify scheduled tasks:

SCHTASKS /CHANGE [/S system [/U username [/P [password]]]] /TN taskname [/RU username2] [/RP password2] [/TR program] [/ST starttime] [/RI interval] [ {/ET endtime | /DU duration} [/K] ] [/SD startdate] [/ED enddate] [/ENABLE | /DISABLE] [/IT] [/RL level] [/Z] [/DELAY delay] [/HRESULT] [/?]

Where:

  • /S system - Specifies the remote system to connect to. If not specified, the local system will be assumed.
  • /U username - Specifies the user associated with the scheduled task you want to modify.
  • /P [password] - Specifies the password associated with the user username. If not specified, the user running the command will be prompted for it.
  • /TN taskname - Specify the path\name of the scheduled task to modify.
  • /RU username2 - Changes the user account used to run the task. For the system account, valid values are "", "NT AUTHORITY\SYSTEM", or SYSTEM. For v2 tasks, you can also use "NT AUTHORITY\LOCALSERVICE" and "NT AUTHORITY\NETWORKSERVICE" in addition to the associated SIDs.
  • /RP password2 - Specifies a new password for the user account used to run the task or the password associated with the new user username2. Ignored for the system account.
  • /TR program - Changes the path or name of the program to run.
  • /ST starttime - Changes the start time of the task execution in hh:mm format.
  • /RI interval - Changes the repetition interval to minutes. Does not apply to the MINUTE, HOURLY, ONSTART, ONLOGON, ONIDLE, or ONEVENT schedule types. You can specify a number between 1 and 599940.
  • /ET endtime - Changes the end time of the task execution in the hh:mm format. Does not apply to ONSTART, ONLOGON, ONIDLE, or ONEVENT schedule types.
  • /DU duration - Changes how long the task runs. Does not apply to ONSTART, ONLOGON, ONIDLE, or ONEVENT schedule types.
  • /K - Kills activity once endtime or duration is reached. Does not apply to the ONSTART schedule type.
  • /SD startdate - Changes the date the task was first run in the dd/mm/yyyy format (depends on locale). Does not apply to the ONCE, ONSTART, ONLOGON, ONIDLE, or ONEVENT schedule types.
  • /ED enddate - Changes the date after which the task will not be executed anymore in the dd/mm/yyyy format (depends on locale). Does not apply to the ONCE, ONSTART, ONLOGON, ONIDLE, or ONEVENT schedule types.
  • /IT - Allows the task to run interactively if the user username2 is logged in when the process runs. In this case, the task runs only if the user is logged in.
  • /RL level - Changes the execution level, where level is LIMITED or HIGHEST.
  • /ENABLE - Enables scheduled task.
  • /DISABLE - Disables scheduled task.
  • /Z - Marks the task for deletion after the last run.
  • /DELAY delay - Changes the wait time after the trigger fires in the format mmmm:ss (minutes and seconds). Applies only to the ONSTART, ONLOGON, and ONEVENT schedule types.
  • /HRESULT - Uses the HRESULT format for the process exit code to aid in diagnostics.
  • /? - Displays help for the SCHTASKS /CHANGE command.

Examples:

1. Edit the scheduled task called Muerte by user luser with password passwrod on the remote computer myneighbor, changing the user account to run in Stinky:

schtasks /change /s myneighbor /u luser /p passwrod /tn Muerte /ru Stinky

 

2. Edit the scheduled task called BullshittingMaNonTroppo, changing the program to Minecraft.exe and enabling interactive mode:

schtasks /change /tn BullshittingMaNonTroppo /tr Minecraft.exe /it

 

Syntax to run a scheduled task immediately:

SCHTASKS /RUN [/S system [/U username [/P [password]]]] [/I] /TN taskname [/HRESULT] [/?]

Where:

  • /S system - Specifies the remote system to connect to. If not specified, the local system will be assumed.
  • /U username - Specifies the user associated with the scheduled task you want to run.
  • /P [password] - Specifies the password associated with the user username. If not specified, the user running the command will be prompted for it.
  • /I - Executes the activity immediately, ignoring any constraints.
  • /TN taskname - Specifies path\name of the scheduled task to run.
  • /HRESULT - Uses the HRESULT format for the process exit code to aid in diagnostics.
  • /? - Displays help for the SCHTASKS /RUN command.

Examples:

1. Immediately run the scheduled task named Muerte by user luser with password passwrod on the remote computer myneighbor, ignoring any constraints:

schtasks /run /s myneighbor /u luser /p passwrod /i /tn Muerte

 

2. Immediately run the scheduled task named ProcrastinationMode:

schtasks /run /tn ProcrastinationMode

 

Syntax to terminate a running scheduled task:

SCHTASKS /END [/S system [/U username [/P [password]]]] /TN taskname [/HRESULT] [/?]

Where:

  • /S system - Specifies the remote system to connect to. If not specified, the local system will be assumed.
  • /U username - Specifies the user associated with the scheduled task you want to terminate.
  • /P [password] - Specifies the password associated with the user username. If not specified, the user running the command will be prompted for it.
  • /TN taskname - Specify path\name of the scheduled task to terminate.
  • /HRESULT - Uses the HRESULT format for the process exit code to aid in diagnostics.
  • /? - Displays help for the SCHTASKS /END command.

Example: End the scheduled task called ProcrastinationMode:

schtasks /end /tn ProcrastinationMode
rem Stop procrastinating!

 

Syntax to display the security identifier (SID) of a scheduled task:

SCHTASKS /SHOWSID /TN taskname [/HRESULT] [/?]

Where:

  • /TN taskname - Specifies path\name of the scheduled task for which you want to show the SID.
  • /HRESULT - Uses the HRESULT format for the process exit code to aid in diagnostics.
  • /? - Displays help for the SCHTASKS /SHOWSID command.

Example: View the SID of the scheduled task called ProcrastinationMode:

schtasks /showsid /tn ProcrastinationMode

 

Further information:

To find out your computer name, simply type:

echo %computername%

Press Enter… and voila! Here is your computer name.

Comments

Post a Comment