• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 492
  • Last Modified:

Scheduled Tasks

Hi,
I was just browsing on my network, and I noticed that if I use Explorer to browse onto one of the workstations, and check the Windows/Tasks folder, the scheduled tasks that I know are there do not show up. Even if I use a command line to browse there, and use the Attrib *.* command, non of the tasks (*.job) files show up. I know the jobs are there, because I copied them there and used the "schtasks" command to set parameters and run them. If the jobs weren't there,  there would have been errors reported when I attempted to do this. What's up?
0
westone
Asked:
westone
  • 5
  • 5
1 Solution
 
Seth_zinCommented:
When you ran the SCHTASKS you got a message saying "SUCCESS: The scheduled task..." etc right? And just to make sure the the /S (to set it up on a remote machine worked) check your local computer's tasks see if it made them in there instead.
0
 
westoneAuthor Commented:
I used psexec to run the command on the remote stations. And it did result in a message that said Success when I updated the parameters for the tasks.

I checked that Hide Protected Operating system files was unchecked, and Show Hidden files was checked in Explorer, but that wasn't the problem.
0
 
westoneAuthor Commented:
Oh, and also, if schtasks.exe is used to attempt to run or update a task that does not exists, it will state that no such task exists.
0
Cloud Class® Course: Certified Penetration Testing

This CPTE Certified Penetration Testing Engineer course covers everything you need to know about becoming a Certified Penetration Testing Engineer. Career Path: Professional roles include Ethical Hackers, Security Consultants, System Administrators, and Chief Security Officers.

 
Seth_zinCommented:
If you don't mind, can you paste the full command (without the U and P of course) you typed in to create the task? (including psexec). I want to try it the way you've done it and see if I can reproduce the issue on my end.
0
 
westoneAuthor Commented:
I didn't use Schtasks to create the job, though it is possible. I just copied the job to the Tasks folder and then used Schtasks.exe to set the run credentials, other wise it wouldn't run since the Run As credentials do not get copied. But here are the 4 steps I used:

This first step copies the task file (A Disk Cleanup task) from the server to the Windows\Tasks folder of every workstation listed in the file "complist.txt":
FOR /f %%a in (complist.txt) do copy diskcln.job \\%%a\c$\windows\tasks\diskcln.job /y

The second step copies a .reg file containing Disk Cleanup Sage settings to the system path of each PC:
FOR /f %%a in (complist.txt) do copy cleanmgr.reg \\%%a\c$\windows\system32

This step runs the .reg file to apply the Sage settings on each computer:
FOR /f %%a in (complist.txt) do c:\windows\system32\pstools\psexec \\%%a regedit /s cleanmgr.reg

This last step applies the user credentials to be used to run the task. This is the step that would return a "No such Task exist" message if it did not find the job:
FOR /f %%a in (complist.txt) do c:\windows\system32\pstools\psexec \\%%a schtasks /change /tn diskcln /ru usernamehere /rp passwordhere
0
 
westoneAuthor Commented:
Okay here is the issue, it is not completely resolved but I figured out what what the problem is: On the machine where I am not able to see the tasks in the task folder, the drive is formatted with a FAT32 file system. All the other machines where the Tasks show up normally, either from a command prompt or the explorer browser, are formatted as NTFS. But still, on the FAT32 drive, something is there somewhere because I can use schtasks.exe on the  command line and get successful results on tasks that do not show up in the directory. I do not think the tasks were actually running as scheduled, although there is really no way to tell one way or the other.
0
 
Seth_zinCommented:
Sorry about not replying I couldn't figure out the issue. However, to test if the task is actually running as schedule just make a new one the same way but have the task do something you can check. Like create a batch file that outputs a file called successful.txt on the C drive or something similar that you can check the results (or check the log listed below). However, I would think that you would see it in the directory.

Can you also check the task scheduler on the local computer? Control Panel -> Scheduled Tasks are the tasks there? I don't have a FAT32 to try this out on so I can't try to emulate it here.

Also there is a log entry made every time a tasks runs. Go to the computer you wish to check. Open Scheduled Tasks, click Advanced (up by file edit view etc...) then click view log. Also, maybe they are hidden task for some reason, you can unhide tasks from the advanced menu. I'll let you know if I find out anything else.
0
 
westoneAuthor Commented:
I did check the Scheduled Tasks folder of the local computer and no tasks showed up. The only reason I know something is there is the successful schtasks.exe commands. I did not check the logs but will. I don't expect to find anything, I don't see how a task could have been running.
0
 
Seth_zinCommented:
I would double check that view hidden tasks is checked via the advanced menu. Like you said, it would have given an error if you used a /change command on a job that wasn't there. Also, you may have tried this, do a search via windows search to for *.job file on the whole C drive not just that one folder see if anything comes up. Grasping at straws here atm. Since it let you use /change maybe it's something as simple as hidden or in a different location. Very strange to say the least once you checked to see if the logs say it ran I will see what else I can find.
0
 
Seth_zinCommented:
Also, just to rule things out lets assume /change is working for whatever reason on a job that isn't there (false positive) try a couple things.

1) Try creating a task with the exact same name at the local computer itself via the wizard or command prompt. It shouldn't let you, will tell you that one by that name already exist. (psexec would probably work fine)

2) All computers have a "windows" folder and not "winnt" right? Since they are FAT32 it made me wonder if the reason was it was upgraded from older OS. In which case the copy obviously wouldn't of worked since you tell it to go to "windows" folder.

3) The other way would be to try and run the /change command with a fake job name that you know is not there. Does that report positive results?

4) Manually copy the .job file over into the correct folder (if you are copying it via a script it should be there whether it works or not) and see if it shows up in control panel -> scheduled tasks. If so then something with the copy portion of the script doesn't sit well with the FAT32 setup. Again maybe it hides it for some reason?

5) Finally double check to make sure it isn't hidden (advanced menu) and that the logs don't show that it ran (advanced menu again).

If they do show it ran then it's a whole different solution path. Since I don't have a FAT32 I can't try it out here so at this point I am grasping at straws but eventually (if you don't give up first hah) something will pop up with the answer.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 5
  • 5
Tackle projects and never again get stuck behind a technical roadblock.
Join Now