Object Access Event: 4699

Event ID 4699 – A Scheduled Task Was Deleted

Event 4699 is logged whenever a schedule task is deleted, and is an important change control event. Events related to this event are 4698, 4700, 4701, and 4702. The user who initiates the deletion can be identified by the log data.

This log data provides the following information:

• Security ID
• Account Name
• Account Domain
• Logon ID
• Task Name
• Task Content

Why does event ID 4699 need to be monitored?

• This should be monitored particularly on critical computers and devices, as malware uses schedules tasks to stay in the system after a reboot.
• Scheduled tasks created by malware can be found in the Task Scheduler Library root node. Deletion of these tasks is a sign of malicious activity.
• Critical tasks should never be deleted, so the Task Name field of this event must be monitored.

Pro Tip:

Through real-time email and SMS alerts, ADAudit Plus notifies the administrator about the scheduled tasks as and when they are deleted on the windows server, thus helping you meet your security, operational, and compliance needs with absolute ease.