If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below. |
|
|
Thread Tools | Rate Thread | Display Modes |
#1
|
|||
|
|||
Task Scheduler Puzzler
I found to my surprise that task scheduler executed an old backup script
at the time in the task schedule setup. I'd like to change that task. However, when I open Task Scheduler, I cannot find an entry for that task!!! It is not one of the 106 active tasks under Task Scheduler (Local). It is not listed under Task Scheduler Library. And it's definitely not a Microsoft task. So where is it????? |
Ads |
#2
|
|||
|
|||
Task Scheduler Puzzler
Alek wrote:
I found to my surprise that task scheduler executed an old backup script at the time in the task schedule setup. I'd like to change that task. However, when I open Task Scheduler, I cannot find an entry for that task!!! It is not one of the 106 active tasks under Task Scheduler (Local). It is not listed under Task Scheduler Library. And it's definitely not a Microsoft task. So where is it????? In the left tree view panel select the one up folder "Task Scheduler Library" for user tasks Task Scheduler (Local) Task Scheduler Library --here Microsoft S-2-5-..... -- Take care, Jonathan ------------------- LITTLE WORKS STUDIO http://www.LittleWorksStudio.com |
#3
|
|||
|
|||
Task Scheduler Puzzler
Jonathan N. Little wrote on 7/13/2019 4:56 PM:
Alek wrote: I found to my surprise that task scheduler executed an old backup script at the time in the task schedule setup. I'd like to change that task. However, when I open Task Scheduler, I cannot find an entry for that task!!! It is not one of the 106 active tasks under Task Scheduler (Local). It is not listed under Task Scheduler Library. And it's definitely not a Microsoft task. So where is it????? In the left tree view panel select the one up folder "Task Scheduler Library" for user tasks Task Scheduler (Local) Task Scheduler Library --here Microsoft S-2-5-..... Did that. No joy. |
#4
|
|||
|
|||
Task Scheduler Puzzler
Alek wrote:
I found to my surprise that task scheduler executed an old backup script at the time in the task schedule setup. "an old backup script" ... for which backup program? I'd like to change that task. However, when I open Task Scheduler, I cannot find an entry for that task!!! It is not one of the 106 active tasks under Task Scheduler (Local). It is not listed under Task Scheduler Library. And it's definitely not a Microsoft task. In Task Scheduler, and when you expand the Task Scheduler Library node in the tree list, what subcategories are listed there? Microsoft will be one, but are there others? Some backup/sync programs add their own category to Task Scheduler. From your other reply, you showed a subnode named "S-2-5-...". That is the SID (security ID) for a Windows account. Depending on what is the SID's value, could be the All Users (Default) account, your account, the Administrator account, or some other Windows account. You can go into the registry to figure out for which account is that SID by going to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList registry key. The ProfileImagePath specified the %userprofile% folder that that account, and usually that indicates a username. There are standard SIDs that are the same well-known SIDs across all Windows installations, like for the Administrator account. Cannot tell since you didn't give the entire SID value. https://support.microsoft.com/en-us/...rating-systems All the well-known SIDs start with S-1-5-..., so the S-2-5-... that you mentioned is a user account. Whether that is for your account is something you have to determine. You can get a list of non-system SIDs by opening a command shell and running: wmic useraccount get name,sid You sure Task Scheduler has an event defined for this task? If it is for some 3rd party backup software, many of those run their own scheduler that constantly runs as a background process. |
#5
|
|||
|
|||
Task Scheduler Puzzler
Alek wrote:
I found to my surprise that task scheduler executed an old backup script at the time in the task schedule setup. I'd like to change that task. However, when I open Task Scheduler, I cannot find an entry for that task!!! It is not one of the 106 active tasks under Task Scheduler (Local). It is not listed under Task Scheduler Library. And it's definitely not a Microsoft task. So where is it????? Some backup softwares, run their own service which handles the scheduling of backups. Review the services running on the machine and see if such a service is present. Paul |
#6
|
|||
|
|||
Task Scheduler Puzzler
Paul wrote on 7/14/2019 6:21 AM:
Alek wrote: I found to my surprise that task scheduler executed an old backup script at the time in the task schedule setup. I'd like to change that task. However, when I open Task Scheduler, I cannot find an entry for that task!!! It is not one of the 106 active tasks under Task Scheduler (Local). It is not listed under Task Scheduler Library. And it's definitely not a Microsoft task. So where is it????? Some backup softwares, run their own service which handles the scheduling of backups. Review the services running on the machine and see if such a service is present. I'm using a BAT file that contains xxcopy commands, so no backup software per se. |
#7
|
|||
|
|||
Task Scheduler Puzzler
Alek wrote:
Paul wrote on 7/14/2019 6:21 AM: Alek wrote: I found to my surprise that task scheduler executed an old backup script at the time in the task schedule setup. I'd like to change that task. However, when I open Task Scheduler, I cannot find an entry for that task!!! It is not one of the 106 active tasks under Task Scheduler (Local). It is not listed under Task Scheduler Library. And it's definitely not a Microsoft task. So where is it????? Some backup softwares, run their own service which handles the scheduling of backups. Review the services running on the machine and see if such a service is present. I'm using a BAT file that contains xxcopy commands, so no backup software per se. You can search the drive, end to end, with the "raw disk access" feature of HxD. You will be searching for the name of the bat file "backup.bat" or similar. It depends on how desperate you are to find this item. HxD can search at around 600MB/sec if the storage device is fast enough for that. https://mh-nexus.de/en/hxd/ Raw disk access required elevating to Administrator ("Run as Administrator"). Ordinary hexing of individual files can be run as a limited user, but disk access needs permissions. Unfortunately, the existence of "Recently used" and other caching features (the cached searches for the file and so on), will mean more than one hit during a search. What you're looking for, is some kind of structure proving where it's stored and being acted upon. You've tried using the GUI and that didn't work. Maybe you've tried a registry search, that would be another place to look that will take a few minutes to complete. Paul |
#8
|
|||
|
|||
Task Scheduler Puzzler
VanguardLH wrote on 7/14/2019 1:09 AM:
Alek wrote: I found to my surprise that task scheduler executed an old backup script at the time in the task schedule setup. "an old backup script" ... for which backup program? I'd like to change that task. However, when I open Task Scheduler, I cannot find an entry for that task!!! It is not one of the 106 active tasks under Task Scheduler (Local). It is not listed under Task Scheduler Library. And it's definitely not a Microsoft task. In Task Scheduler, and when you expand the Task Scheduler Library node in the tree list, what subcategories are listed there? Microsoft will be one, but are there others? Some backup/sync programs add their own category to Task Scheduler. Just Microsoft, which itself has 4 subcategories. From your other reply, you showed a subnode named "S-2-5-...". That was Jon Little. That is the SID (security ID) for a Windows account. Depending on what is the SID's value, could be the All Users (Default) account, your account, the Administrator account, or some other Windows account. You can go into the registry to figure out for which account is that SID by going to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList registry key. The ProfileImagePath specified the %userprofile% folder that that account, and usually that indicates a username. There are standard SIDs that are the same well-known SIDs across all Windows installations, like for the Administrator account. Cannot tell since you didn't give the entire SID value. https://support.microsoft.com/en-us/...rating-systems All the well-known SIDs start with S-1-5-..., so the S-2-5-... that you mentioned is a user account. Whether that is for your account is something you have to determine. S-1-5-18 is systemprofile S-1-5-19 is LocalService S-1-5-20 is NetWorkService S-1-5-21-2425112569-1092402255-3852354745-1004 is the owner of the machine S-1-5-21-2425112569-1092402255-3852354745-500 is Administrator You can get a list of non-system SIDs by opening a command shell and running: wmic useraccount get name,sid Microsoft Windows [Version 10.0.18362.239] (c) 2019 Microsoft Corporation. All rights reserved. C:\WINDOWS\system32 wmic useraccount get name,sid Name SID Administrator S-1-5-21-2425112569-1092402255-3852354745-500 DefaultAccount S-1-5-21-2425112569-1092402255-3852354745-503 Guest S-1-5-21-2425112569-1092402255-3852354745-501 pjh42 S-1-5-21-2425112569-1092402255-3852354745-1004 pjh42_i9lu20k S-1-5-21-2425112569-1092402255-3852354745-1005 WDAGUtilityAccount S-1-5-21-2425112569-1092402255-3852354745-504 |
#9
|
|||
|
|||
Task Scheduler Puzzler
UPDATE: it's gone! The script did not run last night so nothing showed
up. I'll keep my fingers crossed. Thanks for the suggestions. |
#10
|
|||
|
|||
Task Scheduler Puzzler
Alek wrote:
VanguardLH wrote: From your other reply, you showed a subnode named "S-2-5-...". That was Jon Little. Oops, then never mind the stuff about figuring out the SID. Alas, Task Scheduler provides no means to search through its list of events, like to find whichever one runs your .bat file with the xxcopy commands. You could try using SysInternals' AutoRuns. Load Autoruns and go to its Options menu to deselect "Hide Microsoft entries". Just in case, also deselect "Hide Windows entries." Then enter the name of your batch file in the filter box. See if AutoRuns can find a scheduled event containing that string. While the GUI version of Task Scheduler won't let you do a search, you could use the command-line version: schtasks.exe. That won't do a search, either; however, you could pipe its output into a file, load the file into Notepad, and do a search in Notepad on the .bat filename. The /xml switch says to display each event in XML format, so all its attributes get listed, like the actions (which are the commands to run). Open a command shell and run: schtasks /query /xml tasklist.txt && notepad tasklist.txt |
Thread Tools | |
Display Modes | Rate This Thread |
|
|