Is there a way to tell if my program was started by the Task Scheduler?

Question

Todd Chester 711

Answer accepted by question author

0 additional answers

Answer 1

RLWA32 52,101

The parent process of a program started by the Task Scheduler will be an instance of svchost.exe.

There are various ways to obtain a parent process id.

What is the problem that you are trying to solve?

Todd Chester 711 Reputation points

2022-12-12T02:13:42.963+00:00

No problem yet. I was arranging my NativeWinUtils.pm6 module of Windows helpers and thought it might be come in handy at some point.
RLWA32 52,101 Reputation points

2022-12-12T03:07:37.837+00:00

Well, the general idea would be obtain your program's parent process id. This can be obtained from the PROCESS_BASIC_INFORMATION structure returned by NtQueryInformationProcess function, from an instance of the WMI Win32_Process class or from or from a PROCESSENTRY32 structure retrieved from a Toolhelp snapshot (CreateToolhelp32Snapshot function).

Once you have the parent process id you can compare it to the process id of the process hosting the Task Scheduler service. You would need to call OpenSCManagerA function, OpenServiceA function for the Task Scheduler service and then call QueryServiceStatusEx function to obtain a SERVICE_STATUS_PROCESS structure that contains the process id of the service.