Query on Group policy

Question

Hi All,

I want to capture Scheduled Task Event logs, i.e., when a scheduled task is created, updated, modified, or deleted.

Can I achieve this using the below GPO?

Computer Configuration --> Policies --> Windows Settings --> Security Settings --> Advanced Audit Policy Configuration -->

Audit Policies --> Object Access --> Audit Other Object Access Events.

Where can I see the logs after enabling the GPO? In the Event Viewer, I have expanded Application and Services Logs, but I don't see anything related to Task events.

Answer 1

Hello Glenn Maxwell,

Thank you for posting in Q&A forum.

Where can I see the logs after enabling the GPO? In the Event Viewer, I have expanded Application and Services Logs, but I don't see anything related to Task events.
A: Windows Security logs.

You can see the event ID here.

For example:

After you enable the GPO above, you can run gpupdate /force on the machine that applies this gpo, and after you create a scheduled task, then you can go to security log to find event ID 4698.

For more information, please refer to link below.

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-other-object-access-events

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.