Task Scheduler Puzzler

I found to my surprise that task scheduler executed an old backup script
at the time in the task schedule setup.

I'd like to change that task.

However, when I open Task Scheduler, I cannot find an entry for that task!!!

It is not one of the 106 active tasks under Task Scheduler (Local).

It is not listed under Task Scheduler Library.

And it's definitely not a Microsoft task.

So where is it?????

Alek wrote:
I found to my surprise that task scheduler executed an old backup script
at the time in the task schedule setup.

I'd like to change that task.

However, when I open Task Scheduler, I cannot find an entry for that task!!!

It is not one of the 106 active tasks under Task Scheduler (Local).

It is not listed under Task Scheduler Library.

And it's definitely not a Microsoft task.

So where is it?????

In the left tree view panel select the one up folder "Task Scheduler
Library" for user tasks


Task Scheduler (Local)
Task Scheduler Library --here
Microsoft
S-2-5-.....


--
Take care,

Jonathan
-------------------
LITTLE WORKS STUDIO
http://www.LittleWorksStudio.com

Jonathan N. Little wrote on 7/13/2019 4:56 PM:
Alek wrote:
I found to my surprise that task scheduler executed an old backup script
at the time in the task schedule setup.

I'd like to change that task.

However, when I open Task Scheduler, I cannot find an entry for that task!!!

It is not one of the 106 active tasks under Task Scheduler (Local).

It is not listed under Task Scheduler Library.

And it's definitely not a Microsoft task.

So where is it?????

In the left tree view panel select the one up folder "Task Scheduler
Library" for user tasks


Task Scheduler (Local)
Task Scheduler Library --here
Microsoft
S-2-5-.....



Did that. No joy.

Alek wrote:

I found to my surprise that task scheduler executed an old backup
script at the time in the task schedule setup.

"an old backup script" ... for which backup program?

I'd like to change that task. However, when I open Task Scheduler, I
cannot find an entry for that task!!!

It is not one of the 106 active tasks under Task Scheduler (Local).
It is not listed under Task Scheduler Library. And it's definitely
not a Microsoft task.

In Task Scheduler, and when you expand the Task Scheduler Library node
in the tree list, what subcategories are listed there? Microsoft will
be one, but are there others? Some backup/sync programs add their own
category to Task Scheduler.

From your other reply, you showed a subnode named "S-2-5-...". That is
the SID (security ID) for a Windows account. Depending on what is the
SID's value, could be the All Users (Default) account, your account, the
Administrator account, or some other Windows account. You can go into
the registry to figure out for which account is that SID by going to the

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

registry key. The ProfileImagePath specified the %userprofile% folder
that that account, and usually that indicates a username. There are
standard SIDs that are the same well-known SIDs across all Windows
installations, like for the Administrator account. Cannot tell since
you didn't give the entire SID value.

https://support.microsoft.com/en-us/...rating-systems

All the well-known SIDs start with S-1-5-..., so the S-2-5-... that you
mentioned is a user account. Whether that is for your account is
something you have to determine. You can get a list of non-system SIDs
by opening a command shell and running:

wmic useraccount get name,sid

You sure Task Scheduler has an event defined for this task? If it is
for some 3rd party backup software, many of those run their own
scheduler that constantly runs as a background process.

Alek wrote:
I found to my surprise that task scheduler executed an old backup script
at the time in the task schedule setup.

I'd like to change that task.

However, when I open Task Scheduler, I cannot find an entry for that task!!!

It is not one of the 106 active tasks under Task Scheduler (Local).

It is not listed under Task Scheduler Library.

And it's definitely not a Microsoft task.

So where is it?????


Some backup softwares, run their own service which handles
the scheduling of backups.

Review the services running on the machine and see
if such a service is present.

Paul

Paul wrote on 7/14/2019 6:21 AM:
Alek wrote:
I found to my surprise that task scheduler executed an old backup script
at the time in the task schedule setup.

I'd like to change that task.

However, when I open Task Scheduler, I cannot find an entry for that task!!!

It is not one of the 106 active tasks under Task Scheduler (Local).

It is not listed under Task Scheduler Library.

And it's definitely not a Microsoft task.

So where is it?????


Some backup softwares, run their own service which handles
the scheduling of backups.

Review the services running on the machine and see
if such a service is present.

I'm using a BAT file that contains xxcopy commands, so no backup
software per se.

Alek wrote:
Paul wrote on 7/14/2019 6:21 AM:
Alek wrote:
I found to my surprise that task scheduler executed an old backup script
at the time in the task schedule setup.

I'd like to change that task.

However, when I open Task Scheduler, I cannot find an entry for that task!!!

It is not one of the 106 active tasks under Task Scheduler (Local).

It is not listed under Task Scheduler Library.

And it's definitely not a Microsoft task.

So where is it?????

Some backup softwares, run their own service which handles
the scheduling of backups.

Review the services running on the machine and see
if such a service is present.

I'm using a BAT file that contains xxcopy commands, so no backup
software per se.

You can search the drive, end to end, with the
"raw disk access" feature of HxD. You will be searching
for the name of the bat file "backup.bat" or similar.

It depends on how desperate you are to find this item.

HxD can search at around 600MB/sec if the storage
device is fast enough for that.

https://mh-nexus.de/en/hxd/

Raw disk access required elevating to Administrator ("Run as Administrator").
Ordinary hexing of individual files can be run as
a limited user, but disk access needs permissions.

Unfortunately, the existence of "Recently used" and other
caching features (the cached searches for the file and so on),
will mean more than one hit during a search. What you're looking
for, is some kind of structure proving where it's stored and
being acted upon. You've tried using the GUI and that
didn't work. Maybe you've tried a registry search,
that would be another place to look that will take
a few minutes to complete.

Paul

VanguardLH wrote on 7/14/2019 1:09 AM:
Alek wrote:

I found to my surprise that task scheduler executed an old backup
script at the time in the task schedule setup.

"an old backup script" ... for which backup program?

I'd like to change that task. However, when I open Task Scheduler, I
cannot find an entry for that task!!!

It is not one of the 106 active tasks under Task Scheduler (Local).
It is not listed under Task Scheduler Library. And it's definitely
not a Microsoft task.

In Task Scheduler, and when you expand the Task Scheduler Library node
in the tree list, what subcategories are listed there? Microsoft will
be one, but are there others? Some backup/sync programs add their own
category to Task Scheduler.


Just Microsoft, which itself has 4 subcategories.

From your other reply, you showed a subnode named "S-2-5-...".


That was Jon Little.

That is
the SID (security ID) for a Windows account. Depending on what is the
SID's value, could be the All Users (Default) account, your account, the
Administrator account, or some other Windows account. You can go into
the registry to figure out for which account is that SID by going to the

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

registry key. The ProfileImagePath specified the %userprofile% folder
that that account, and usually that indicates a username. There are
standard SIDs that are the same well-known SIDs across all Windows
installations, like for the Administrator account. Cannot tell since
you didn't give the entire SID value.

https://support.microsoft.com/en-us/...rating-systems

All the well-known SIDs start with S-1-5-..., so the S-2-5-... that you
mentioned is a user account. Whether that is for your account is
something you have to determine.

S-1-5-18 is systemprofile
S-1-5-19 is LocalService
S-1-5-20 is NetWorkService
S-1-5-21-2425112569-1092402255-3852354745-1004 is the owner of the machine
S-1-5-21-2425112569-1092402255-3852354745-500 is Administrator


You can get a list of non-system SIDs
by opening a command shell and running:

wmic useraccount get name,sid

Microsoft Windows [Version 10.0.18362.239]
(c) 2019 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32 wmic useraccount get name,sid
Name SID
Administrator S-1-5-21-2425112569-1092402255-3852354745-500
DefaultAccount S-1-5-21-2425112569-1092402255-3852354745-503
Guest S-1-5-21-2425112569-1092402255-3852354745-501
pjh42 S-1-5-21-2425112569-1092402255-3852354745-1004
pjh42_i9lu20k S-1-5-21-2425112569-1092402255-3852354745-1005
WDAGUtilityAccount S-1-5-21-2425112569-1092402255-3852354745-504

UPDATE: it's gone! The script did not run last night so nothing showed
up. I'll keep my fingers crossed.

Thanks for the suggestions.

Alek wrote:

VanguardLH wrote:

From your other reply, you showed a subnode named "S-2-5-...".

That was Jon Little.

Oops, then never mind the stuff about figuring out the SID.

Alas, Task Scheduler provides no means to search through its list of
events, like to find whichever one runs your .bat file with the xxcopy
commands. You could try using SysInternals' AutoRuns.

Load Autoruns and go to its Options menu to deselect "Hide Microsoft
entries". Just in case, also deselect "Hide Windows entries." Then
enter the name of your batch file in the filter box. See if AutoRuns
can find a scheduled event containing that string.

While the GUI version of Task Scheduler won't let you do a search, you
could use the command-line version: schtasks.exe. That won't do a
search, either; however, you could pipe its output into a file, load the
file into Notepad, and do a search in Notepad on the .bat filename. The
/xml switch says to display each event in XML format, so all its
attributes get listed, like the actions (which are the commands to run).
Open a command shell and run:

schtasks /query /xml tasklist.txt && notepad tasklist.txt