Step 1: Enable Group Policy Auditing

Logon to your domain controller with administrative privileges and launch the Group Policy Management Console.

Right-click the appropriate Group Policy Object linked to the Domain Controllers container and select Edit.

Expand the Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configurations → Audit Policies → Audit Policy node → Object Access → Audit Other Object Access Events

Configure the properties for both 'success' and 'failure'. Exit Group Policy Management Editor.

In the Group Policy Management Console, choose the modified GPO, and click 'Add' in the 'Security' section on the right pane. Type 'Everyone' in the text box and click 'Check Names' to include the value. Exit the Group Policy Management Console.

To enforce these changes throughout the domain, run the command 'gpupdate /force', in the "Run" console.

Step 2: Allow AD Auditing through ADSI Edit

From your 'Server Manager' go to 'Tools' and select 'ADSI Edit'.

Right click 'ADSI Edit' node from the left pane and select 'Connect to' option. This pulls up the 'Connection Settings' window.

Select the 'Default Naming Context' option from the 'Select a well-known Naming Context' drop down list.

Click 'OK' and return to the ADSI Edit window. Expand 'Default Naming Context' and select the associated 'DC' subnode. Right-click this subnode and click 'Properties'.

In the 'Properties' window, go to the 'Security' tab and select 'Advanced'. After that, select 'Auditing' tab and click 'Add'.

Click on ' Select a principal'. This will bring up a 'Select User, Computer or Group' window. Type 'Everyone' in the textbox and verify it with 'Check Names'.

The 'Principal' in the 'Auditing Entry' window now shows 'Everyone'. In the 'Type' drop-down select 'All' to audit for both 'success' and 'failure' events.

In the 'Select' drop-down choose 'This object and all descendant object's. This allows the auditing of the OU's descendant objects. Select 'Full Control' in the 'Permissions' section.

This selects all the checkboxes available. Unselect the following check boxes:

1. Full Control

2. List Contents

3. Read all properties

4. Read permissions

Step 3: View Events in Event Viewer.

You can monitor scheduled tasks by accessing 'Security Logs' in the 'Event Viewer'. You can filter your log to look for the following event.

Event ID: 4698 describes a task that has been scheduled.