hello.
i have a very important task that i added to the task scheduler.
i want to protect the task from delete it or disable it - but i don't found the right way to do it.
so, i ask if somebody know way and how to do it, and if no, how i can to block the TS whole with the registry or gpo?
i searched i lot of time in google but without results.
many thanks in advance!
Only Admin users can alter your tasks.
You can test this for yourself.
Create a task,
create a new local Standard user account for use in the test,
log in to the new account,
Open Task scheduler.
Repeat the test with a new local Admin user account.
Delete the new user accounts when you have finished or put decent passwords on them.
Denis
hi,
i'm admin. so how i can protect the task from delete or disable? or you know way to protect the task with pasword?
many thanks.
you don't know way to protect the task with password?
- - - Updated - - -
i found that here in registry i can found the list of the tasks:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks
so, maybe you know way that here i will can protect specific task from delete it?
thanks.
It's simple, don't be Admin, make another account that is not Admin and use that for everyday life, and everything (not just tasks) will be protected, asking you for Admin password each time you (or some program or virus) want to modify anything.
That way you kill all flies with one shot.
hi,
maybe you know or can recommended for alternative task scheduler?
I have been reluctant to post again because I really do not understand what the requirement actually is. Surely you are able to stop yourself deleting or disabling the task as well as any software solution could ever do.
However, one thing you could do is examine the Registry entry for your task automatically so that you can notify yourself if the task is disabled or deleted.
- Deleting the task could be detected by a script that attempted to extract the task hash entry in the Registry. The hash value would not be there to extract if the task was deleted.
- Disabling the task could be detected by a script that attempted to extract the task hash entry in the Registry. The hash value changes when the task is disabled.
- Set the examination to run at every boot, for example, and you'll have a decent notification system.
One solution would be to use Reg Query commands and another would be to use PowerShell.
Denis
Quote