Windows 10: Scheduled Tasks being deleted by NT AUTHORITY\System

Good Afternoon,


Hoping someone can shed some light on this mystery!


In basics, I have two scheduled tasks set by group policy to call upon a .bat script. However, one keeps being deleted by 'NT AUTHORITY\System account for seemingly no reason. This only affects one task and they are identical in set up apart from different names obviously and calling upon different .bat scripts at different times.


Just to clarify, the task is not set to delete after so many days etc.


Please see attached


Many thanks,

Carl







:)

 

Task Scheduler issue

I did a,b, and c and Task Scheduler is non-functional now. Not one single task is shown. Also tried repair install, but still have problem with 'Task Scheduler is not available. Task Scheduler will attempt to reconnect to it'.

 

No permission to disable a task in Task Scheduler

You keep talking about a "folder". Task scheduler items are files, not
folders, even though they have no name extension (i.e. no full stop or anything else to the right of the name).

I suspect the task is protected through its entry in the registry. You need to open the registry editor (regedit.exe), then do this:

• Navigate to this key:
  
  HKLM\SOFTWARE\Microsoft\Windows NT\Current Version\Schedule\TaskCache\Tasks\
• Find "UpdateOrchestrator", using Ctrl+F. It will be against a key such as
  
  {AB62362D-3EF5-4BD4-92E1-D96143FD8738}
• Change the owner of the key to "Administrators"
• Grant full access to "Administrators".
  

You then need to take the same four steps with this key:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\

 

NT Service\TrustedInstaller & NT authority\system

It doesn't log you into another user, you are running cmd.exe under a system process when you use utilman, So anything you then run under cmd.exe is running with the authority of 'NT authority\system'

Kind Regards,

Elise