Oddly named tasks in Task Scheduler revealed

Question

The following relates to oddly named tasks of of the form {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxx}, where "x" is a seemingly random hex digit, which are shown in the "Task Scheduler" Microsoft application in Windows 10.

The following image along with the text below it show how to display these tasks. Click this image to display an enlarged version in a new window.

The Task Scheduler shows and allows control of scheduled background tasks. This can be invoked by entering "Task Scheduler" in the Microsoft (Cortana) Search Box and pressing the Enter key.

This application allows logging of the scheduled background tasks. To enable this click on the "Enable All Tasks History" option in the "Actions" pane on the right side of the display. 

Wait at least 12 hours and then click on the "Task Scheduler(Local)" item in the left hand pane. Then in the dropdown "Task Status" pane in the middle of the display select a time period of "Last 24 hours" or more.

Scroll down to the end of the list and you will see one or more oddly named tasks of the form {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxx}, where "x" is a seemingly random hex digit.

Note these tasks are not shown in the "Active Tasks" pane nor revealed by the "Display All Running Tasks" menu item in the right hand pane.

What are these tasks?

Related questions have been asked in the following links. However none of the answers to these links really answered this question.

https://www.tenforums.com/general-support/92027-what-jd_taskschedulerschedule.html

https://www.bleepingcomputer.com/forums/t/643370/random-weird-scheduled-tasks/

https://answers.microsoft.com/en-us/windows/forum/all/oddly-named-tasks-in-task-scheduler/11dcde4f-ca47-4dc6-8267-4884b3a1ed8c 

The original question on this forum has been closed off hence I have created this anew  as I have discovered the answer (below) which will help others with the same question.

Cheers

Andy Bruin

Answer 1

The strangely named tasks are UUIDs generated by the WPScheduler DLL module of the Task Scheduler service.

The event in the event viewer corresponding to this task UUID gives the following action name where the last part of the name is a randomized UUID: 

Global\JD_TaskSchedulerSchedule_{1FD0D37B-B601-416A-A514-18F85532623E}

This is generated by the SyncController DLL module of the "Sync Host" service. This service is used by OneSync (formerly known as ActiveSync) to synchronize mail, contacts, and calendars on networked devices including phones.

The actual task schedule name is SimpleActivityScheduleTimer.

The displayed tasks in the Task Status window are scheduled tasks that have been triggered. They include old tasks from previous reboots hence the multiple items. 

Cheers

Andy Bruin

Answer 2

Hi Andy. I'm Greg, an installation specialist, 10 year Windows MVP, and Volunteer Moderator.

Nice find!

More about OneSync here:

http://one-sync.info/what-is-onesync/

https://en.wikipedia.org/wiki/OneSync

I don't have it even though I sync User folders with OneDrive between all of my devices including OneDrive.

Do you have Dropbox?  Any other sync?

Answer 3

Hi Greg,

Thanks for the reply and the info. Saw your response to the original message but had no way of contacting you as it was closed off. 

The solution to this involved deep analysis with Windbg. It's very technically involved but I decided that publishing the technical detail here was too complex for the readers here. Instead I gave a simpler answer and added the informative image in line with the images from original questioner (Big thumbs up for them as it helps people like us).

From the comments on the web it seems that before the Windows 10 anniversary edition it only appeared if using an application that used OneSync but I cannot confirm this. My PC does have Itunes installed (it's not in use) which may or may not use this but no other likely applications. 

According to the web OneDrive (which I don't use) uses OneSync for sync. If so I would expect this task to appear if this is the case unless there is some setting I don't know about.

Just in case you missed it you need to select the "Enable All Tasks History" option (When set it changes to "Disable All Task History") and wait  up to 12 hours for the task to appear in the Task Scheduler log unless one of the other triggers below is triggered. Make sure also the time period is set to "Last 24 hours" or more.

This scheduled task is set to trigger on multiple triggers (Aggregate Trigger). It triggers periodically every 12 hours  or later depending on load. It also triggers on a number of Windows Notification Facility (WNF) notifications including thermal limits, network data usage, and network (including phone) connections and disconnections. Note there is very little web information about WNF but Microsoft uses it often in its newer code.  

It would be appreciated if you can recheck the task status list once these parameters have been satisfied and write back so I can update this article accordingly.

Note I do have a way of getting the complete current task schedule list using Windbg but it is somewhat technical. I'm current looking at ways for a simple application to do this as it will be a useful security tool.

Cheers

Andy Bruin

Answer 4

Andy -

I've enabled task history so will let you know tomorrow if the tasks show up in Task Scheduler (Local),

Answer 5

Hi Greg,

Have some more info.

One Sync

Firstly the links you gave to OneSync are for a non Microsoft app that is unrelated to Microsoft's OneSync. Microsoft OneSync seems to be a Microsoft internal name. There is a mention of it at the following link with the relevant excerpt below

https://www.zdnet.com/article/microsoft-pushes-ahead-with-its-quest-to-make-apps-more-intelligent/ 

That team is building what Microsoft is calling*OneSync, "the unified stack that supports the device platform needs of Outloo*k for the synchronization of People, Email, Calendar and Tasks,"

Incidently the "Unified Stack" designation probably explains the naming of the "unistack" service group which the "Sync Host" service is part of.

One Drive

After a little bit more reseach I've found that OneDrive uses a different protocol than OneSync. Seems these days it uses Microsoft Graph but I'm not 100% authoritative on this. Some more info at the following link. Ignore the confusing heading "One Sync to rule them all" as it's not refering to OneSync!

https://www.theregister.co.uk/2015/01/09/one_sync_to_rule_them_all_how_microsoft_plans_to_fix_onedrive/

ActiveSync

Microsoft OneSync uses ActiveSync as the underlying protocol. ActiveSync was also an app on Windows XP for mobile phone sync but here it refers only to the protocol used. The protocol is also called Exchange ActiveSync and some more info can be found at the following link.

https://en.wikipedia.org/wiki/Exchange_ActiveSync

This protocol is still used for syncing Outlook with mobile phones. It also is used for syncing Outlook with Microsoft Live/Outlook.com as the following link confirms.

https://answers.microsoft.com/en-us/windowslive/forum/all/does-anyone-know-what-mail-protocol-the-new/a9f4b151-3a1d-4b2e-9565-6d2d6c11ccf4

Exchange ActiveSync was also used for syncing Google mail but that seems to of been discontinued for free accounts.

https://www.zdnet.com/article/google-drops-exchange-activesync-support-for-free-email-accounts/

Exchange ActiveSync may be also used for syncing other web applications.

On my PC (which is secondhand) the only apps in use that synced were Itunes to an Ipod (although it doesn't look like ActiveSync is used for this) and a Facebook/Instagram app which may use ActiveSync.

Oddly Named Task

I've managed to examine a vanilla (No syncing apps installed or used) almost brand new PC. It seems that the task isn't running on this but I'm not 100% certain as the user has a habit of completely shutting down the computer at the end of each session (they don't believe in hibernation). 

It may be as you suspect that this task is scheduled once an application that uses ActiveSync is installed or enabled. Alternatively it may be related to the original version of Windows 10 installed.

Cheers

Andy Bruin

PS Would like to hear from you regarding whether the odd task showed up in your log.