Event-o-Pedia EventID 602 - Scheduled Task created [Win 2003]

	Event Details
	Operating System->Microsoft Windows->Built-in logs->Windows 2000-2003->Security Log->Detailed Tracking->EventID 602 - Scheduled Task created [Win 2003]

EventID 602 - Scheduled Task created [Win 2003]

Indicates a either a new scheduled task creation or an existing task modification.

Note:
This event does not get logged when a task is deleted.
This event is not logged on Windows 2000 systems.
Examine the Target Name and Task Time when such events occur at unexpected times.

Find more information about this event on ultimatewindowssecurity.com.

Corresponding events on other OS versions:

Windows 2008

Sample:

        Event Type:     Success Audit
        Event Source:   Security
        Event Category: Detailed Tracking
        Event ID:       602
        Date:           10/26/2009
        Time:           07:41:23
        User:           RESEARCH\ALebovsky
        Computer:       DC1
        Description:
        Scheduled Task created:
        File Name:	C:\WINDOWS\Tasks\At1.job
        Command:	Cleanup.exe
        Triggers:		At 11:30 AM every Mon, Wed, Fri of every week, starting 10/26/2009.
        Time:		10/26/2009 11:30:00 AM
        Flags:		0x1A00003
        Target User:	%{S-1-5-18}
        By:
        User:		Alebovsky
        Domain:		RESEARCH
        Logon ID:		(0x0,0x59DF36)

Log Type:

Windows Event Log

Uniquely Identified By:

Log Name:

Security

Filtering Field	Equals to Value
OSVersion	Windows 2003
Category	Detailed Tracking
Source	Security
EventId	602

Field Matching

Field	Description	Stored in	Sample Value
DateTime	Date/Time of event origination in GMT format.	DateTime	10.10.2000 19:00:00
Source	Name of an Application or System Service originating the event.	Source	Security
Type	Warning, Information, Error, Success, Failure, etc.	Type	Success
User	Domain\Account name of user/service/computer initiating event.	-
Computer	Name of server workstation where event was logged.	Computer	DC1
EventID	Numerical ID of event. Unique within one Event Source.	EventId	576
Description	The entire unparsed event message.	Description	Special privileges assigned to new logon.
Log Name	The name of the event log (e.g. Application, Security, System, etc.)	LogName	Security
Category	A name for a subclass of events within the same Event Source.	Category	Logon/Logoff
File Name	File name and full path to the task	InsertionString1	C:\WINDOWS\Tasks\At1.job
Command	File name and full path to the command which is run by the task	InsertionString2	Cleanup.exe
Triggers	Times when the task will run, or events triggering the task run	InsertionString3	At 11:30 AM every Mon, Wed, Fri of every week, starting 10/26/2009.
Time	Time this task will run next	InsertionString%4 %5	10/26/2009 11:30:00 AM
Flags		InsertionString5	0x1A00003
Target User	User that the task runs under	InsertionString6	%{S-1-5-18}
User	User that created or modified the task	-
Domain	Domain of the user that created or modified the task	InsertionString8
Logon ID	ID of the logon session of the user that created or modified task. Allows to correlate other activity of this user during the same logon session.	InsertionString9