Event Details
Operating System->Microsoft Windows->Built-in logs->Windows 2000-2003->Security Log->Detailed Tracking->EventID 602 - Scheduled Task created [Win 2003]
EventID 602 - Scheduled Task created [Win 2003]
Indicates a either a new scheduled task creation or an existing task modification.

This event does not get logged when a task is deleted.
This event is not logged on Windows 2000 systems.
Examine the Target Name and Task Time when such events occur at unexpected times.

Find more information about this event on ultimatewindowssecurity.com.

Corresponding events on other OS versions:

Windows 2008
        Event Type:     Success Audit
        Event Source:   Security
        Event Category: Detailed Tracking
        Event ID:       602
        Date:           10/26/2009
        Time:           07:41:23
        User:           RESEARCH\ALebovsky
        Computer:       DC1
        Scheduled Task created:
        File Name:	C:\WINDOWS\Tasks\At1.job
        Command:	Cleanup.exe
        Triggers:		At 11:30 AM every Mon, Wed, Fri of every week, starting 10/26/2009.
        Time:		10/26/2009 11:30:00 AM
        Flags:		0x1A00003
        Target User:	%{S-1-5-18}
        User:		Alebovsky
        Domain:		RESEARCH
        Logon ID:		(0x0,0x59DF36)
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: Security
Filtering Field Equals to Value
OSVersion Windows 2003
Category Detailed Tracking
Source Security
EventId 602
Field Matching
FieldDescriptionStored inSample Value
DateTime Date/Time of event origination in GMT format. DateTime 10.10.2000 19:00:00
Source Name of an Application or System Service originating the event. Source Security
Type Warning, Information, Error, Success, Failure, etc. Type Success
User Domain\Account name of user/service/computer initiating event. -
Computer Name of server workstation where event was logged. Computer DC1
EventID Numerical ID of event. Unique within one Event Source. EventId 576
Description The entire unparsed event message. Description Special privileges assigned to new logon.
Log Name The name of the event log (e.g. Application, Security, System, etc.) LogName Security
Category A name for a subclass of events within the same Event Source. Category Logon/Logoff
File Name File name and full path to the task InsertionString1 C:\WINDOWS\Tasks\At1.job
Command File name and full path to the command which is run by the task InsertionString2 Cleanup.exe
Triggers Times when the task will run, or events triggering the task run InsertionString3 At 11:30 AM every Mon, Wed, Fri of every week, starting 10/26/2009.
Time Time this task will run next InsertionString%4 %5 10/26/2009 11:30:00 AM
Flags InsertionString5 0x1A00003
Target User User that the task runs under InsertionString6 %{S-1-5-18}
User User that created or modified the task -
Domain Domain of the user that created or modified the task InsertionString8
Logon ID ID of the logon session of the user that created or modified task. Allows to correlate other activity of this user during the same logon session. InsertionString9
You must be logged in to comment