Event ID 4699 – A Scheduled Task Was Deleted
|Category||Object Access: Other Object Access Events|
|Description||A scheduled task was deleted.|
Event 4699 is logged whenever a schedule task is deleted, and is an important change control event. Events related to this event are 4698, 4700, 4701, and 4702. The user who initiates the deletion can be identified by the log data.
This log data provides the following information:
- Security ID
- Account Name
- Account Domain
- Logon ID
- Task Name
- Task Content
Why does event ID 4699 need to be monitored?
- This should be monitored particularly on critical computers and devices, as malware uses schedules tasks to stay in the system after a reboot.
- Scheduled tasks created by malware can be found in the Task Scheduler Library root node. Deletion of these tasks is a sign of malicious activity.
- Critical tasks should never be deleted, so the Task Name field of this event must be monitored.
Through real-time email and SMS alerts, ADAudit Plus notifies the administrator about the scheduled tasks as and when they are deleted on the windows server, thus helping you meet your security, operational, and compliance needs with absolute ease.
Event 4699 applies to the following operating systems:
- Windows 2008 R2 and 7
- Windows 2012 R2 and 8.1
- Windows 2016 and 10
Corresponding event in Windows 2003 and before: 602