Report Scheduled Tasks on servers that have local or domain accounts configured

For one of our customers, I needed to create a report of all Scheduled Tasks on their servers with a local or domain account configured. They required this report because they are switching to stricter group policies and need to know what user accounts should have the “Log on as a batch job” right. In this blog post, I will show you how to create that report 🙂

Challenges

I thought creating a report should be easy. The Get-ScheduledTask should display the configured account. But it doesn’t, so Schtasks.exe should do that, right? I started creating a script using that, and it has issues connecting to servers, throwing ‘Can’t retrieve XML…’ errors, and I couldn’t get that to work reliably.

But… Scheduled Tasks are XML files that are stored in C:\Windows\System32\Tasks 🙂 So, I started creating a script that parsed those files and yielded the desired results. I could now retrieve the server, task name, and credentials when the task was configured to run, regardless of whether the user was logged on.

Running the script

The “Scheduled Tasks inventory.ps1” script will search for all Computer Accounts with a Windows Server operating system, parse all Task Schedules for credentials, and skip things like System, Local Service, etc.

In the example below, it runs against my Windows Server 2022 Domain Controller and my Windows Server 2022 Member server:

When done, it saves a CSV to the location specified at the top of the script. The report lists all Scheduled Tasks that are not running as a built-in/system account. If it didn’t find any, it would report that too.

The script

Below is the script that I made. You can change the $CSVlocation to the location and filename you prefer 🙂 And thanks, Brent Newland, for the additions to it!

$CSVlocation = 'C:\Temp\ScheduledTasks.csv'
$total = foreach ($server in Get-ADComputer -Filter 'OperatingSystem -like "Windows Server*" -and Enabled -ne $False' | Sort-Object Name) {
    try {
        $scheduledtasks = Get-ChildItem "\\$($Server.name)\c$\Windows\System32\Tasks" -Recurse -File -ErrorAction Stop
        Write-Host ("Retrieving Scheduled Tasks list for {0}" -f $server.Name) -ForegroundColor Green
    }
    catch {
        Write-Warning ("Unable to retrieve Scheduled Tasks list for {0}" -f $server.Name)
        $scheduledtasks = $null
    }
    foreach ($task in $scheduledtasks | Sort-Object Name) {
        try {
            $taskinfo = [xml](Get-Content -Path $task.FullName -ErrorAction stop)
        }
        catch {
            Write-Warning ("Could not read {0}" -f $task.FullName)
            $taskinfo = $null
        }
        
        if ($taskinfo.Task.Settings.Enabled -eq 'true' `
                -and $taskinfo.Task.Principals.Principal.GroupId -ne 'NT AUTHORITY\SYSTEM' `
                -and $taskinfo.Task.Principals.Principal.GroupId -ne 'S-1-5-32-544' `
                -and $taskinfo.Task.Principals.Principal.LogonType -ne 'InteractiveToken' `
                -and $taskinfo.Task.Principals.Principal.UserId -ne 'Administrators' `
                -and $taskinfo.Task.Principals.Principal.UserId -ne 'EVERYONE' `
                -and $taskinfo.Task.Principals.Principal.UserId -ne 'INTERACTIVE' `
                -and $taskinfo.Task.Principals.Principal.UserId -ne 'LOCAL SERVICE' `
                -and $taskinfo.Task.Principals.Principal.UserId -ne 'NETWORK SERVICE' `
                -and $taskinfo.Task.Principals.Principal.UserId -ne 'NT AUTHORITY\SYSTEM' `
                -and $taskinfo.Task.Principals.Principal.UserId -ne 'SYSTEM' `
                -and $taskinfo.Task.Principals.Principal.UserId -ne 'S-1-5-18' `
                -and $taskinfo.Task.Principals.Principal.UserId -ne 'S-1-5-19' `
                -and $taskinfo.Task.Principals.Principal.UserId -ne 'S-1-5-20' `
                -and $taskinfo.Task.Principals.Principal.UserId -ne 'USERS' `
                -and $taskinfo.Task.Triggers.LogonTrigger.Enabled -ne 'True' `
                -and $null -ne $taskinfo.Task.Principals.Principal.UserId
        ) {
            [PSCustomObject]@{
                Server    = $Server.name
                TaskName  = $task.Name
                RunAsUser = $taskinfo.Task.Principals.Principal.UserId
            }    
        }
    }
}
if ($total.count -gt 0) {
    $Total | Sort-Object Server, TaskName | Export-Csv -NoTypeInformation -Delimiter ';' -Encoding UTF8 -Path $CSVlocation
    Write-Host ("Saved results to {0}" -f $CSVlocation) -ForegroundColor Green
}
else {
    Write-Warning ("No Scheduled Tasks were found running on local or Domain accounts")
}

Download the script(s) from GitHub here.