Object Access Event: 4699

Active Directory Auditing Tool

The Who, Where and When information is very important for an administrator to have complete knowledge of all activities that occur on their Active Directory. This helps them identify any desired / undesired activity happening. ADAudit Plus assists an administrator with this information in the form of reports. In real-time, ensure critical resources in the network like the Domain Controllers are audited, monitored and reported with the entire information on AD objects - Users, Groups, GPO, Computer, OU, DNS, AD Schema and Configuration changes with 200+ detailed event specific GUI reports and email alerts.

Object Access » Object Access Event: 4699

Event ID 4699 – A Scheduled Task Was Deleted

Event ID 4699
Category Object Access: Other Object Access Events
Type Success Audit
Description A scheduled task was deleted.

Event 4699 is logged whenever a schedule task is deleted, and is an important change control event. Events related to this event are 4698, 4700, 4701, and 4702. The user who initiates the deletion can be identified by the log data.

This log data provides the following information:

  • Security ID
  • Account Name
  • Account Domain
  • Logon ID
  • Task Name
  • Task Content

Why does event ID 4699 need to be monitored?

  • This should be monitored particularly on critical computers and devices, as malware uses schedules tasks to stay in the system after a reboot.
  • Scheduled tasks created by malware can be found in the Task Scheduler Library root node. Deletion of these tasks is a sign of malicious activity.
  • Critical tasks should never be deleted, so the Task Name field of this event must be monitored.

Pro Tip:

Through real-time email and SMS alerts, ADAudit Plus notifies the administrator about the scheduled tasks as and when they are deleted on the windows server, thus helping you meet your security, operational, and compliance needs with absolute ease.

Event 4699 applies to the following operating systems:

  • Windows 2008 R2 and 7
  • Windows 2012 R2 and 8.1
  • Windows 2016 and 10

Corresponding event in Windows 2003 and before: 602