Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Question
Wednesday, April 24, 2019 6:32 PM | 2 votes
Windows 10 (build 1809) runs a Scheduled Task with multiple "on an event" triggers once for each defined trigger, regardless of whether the other event(s) have occurred. This does not occur in Win7 (we haven't checked other Win10 builds).
This undesirable behavior was seemingly confirmed by removing "on an event" triggers, and confirming that the run count did indeed match the number of defined triggers. It has also been independently verified by another source per our inquiry at https://www.experts-exchange.com/questions/29143817/Bug-Windows-10-Scheduled-Task-with-Multiple-Event-Triggers.html. In the interim, our workaround has been to "...not start a new instance" if the task is already running, but this has some pitfalls to the "action" (a script) we're running.
Does anyone know of a hotfix or KB article that addresses this issue, or have any suggestions other than splitting the Task Scheduler into multiple records with one trigger defined per task?
All replies (3)
Wednesday, April 24, 2019 6:36 PM
Here's the XML for the Scheduled Task:
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.3" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo>
<Date>2019-04-24T19:15:20.5553149</Date>
<Author>Me</Author>
<Description>Update user logon status</Description>
<URI>\Update-Logon-Status</URI>
</RegistrationInfo>
<Triggers>
<EventTrigger>
<Enabled>true</Enabled>
<Subscription><QueryList>
<Query Id="0" Path="Microsoft-Windows-GroupPolicy/Operational">
<Select Path="Microsoft-Windows-GroupPolicy/Operational">
*[System[EventID=4018]]
and
(
*[EventData[Data[@Name='ScriptType']=1]]
or
*[EventData[Data[@Name='ScriptType']=2]]
)
</Select>
</Query>
</QueryList></Subscription>
<ValueQueries>
<Value name="EventID">Event/System/EventID</Value>
<Value name="EventRecordID">Event/System/EventRecordID</Value>
<Value name="EventTime">Event/System/TimeCreated/@SystemTime</Value>
<Value name="EventType">Event/EventData/Data[@Name='ScriptType']</Value>
<Value name="EventUser">Event/EventData/Data[@Name='PrincipalSamName']</Value>
</ValueQueries>
</EventTrigger>
<EventTrigger>
<Enabled>true</Enabled>
<Subscription><QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">
*[System[EventID=4800 or EventID=4801]]
and
*[EventData[Data[@Name='TargetDomainName']='DomainXYZ']]
</Select>
</Query>
</QueryList></Subscription>
<ValueQueries>
<Value name="EventDomain">Event/EventData/Data[@Name='TargetDomainName']</Value>
<Value name="EventID">Event/System/EventID</Value>
<Value name="EventRecordID">Event/System/EventRecordID</Value>
<Value name="EventTime">Event/System/TimeCreated/@SystemTime</Value>
<Value name="EventUser">Event/EventData/Data[@Name='TargetUserName']</Value>
</ValueQueries>
</EventTrigger>
<EventTrigger>
<Enabled>true</Enabled>
<Subscription><QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">
*[System[EventID=4778 or EventID=4779]]
and
*[EventData[Data[@Name='AccountDomain']='DomainXYZ']]
</Select>
</Query>
</QueryList></Subscription>
<ValueQueries>
<Value name="EventDomain">Event/EventData/Data[@Name='AccountDomain']</Value>
<Value name="EventID">Event/System/EventID</Value>
<Value name="EventRecordID">Event/System/EventRecordID</Value>
<Value name="EventTime">Event/System/TimeCreated/@SystemTime</Value>
<Value name="EventUser">Event/EventData/Data[@Name='AccountName']</Value>
</ValueQueries>
</EventTrigger>
<EventTrigger>
<Enabled>true</Enabled>
<Subscription><QueryList><Query Id="0" Path="System"><Select Path="System">*[System[Provider[@Name='eventlog'] and EventID=4800]]</Select></Query></QueryList></Subscription>
</EventTrigger>
</Triggers>
<Principals>
<Principal id="Author">
<UserId>S-1-5-18</UserId>
<RunLevel>LeastPrivilege</RunLevel>
</Principal>
</Principals>
<Settings>
<MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>false</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<StopOnIdleEnd>false</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>false</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<DisallowStartOnRemoteAppSession>false</DisallowStartOnRemoteAppSession>
<UseUnifiedSchedulingEngine>true</UseUnifiedSchedulingEngine>
<WakeToRun>false</WakeToRun>
<ExecutionTimeLimit>PT1H</ExecutionTimeLimit>
<Priority>7</Priority>
<RestartOnFailure>
<Interval>PT1M</Interval>
<Count>1</Count>
</RestartOnFailure>
</Settings>
<Actions Context="Author">
<Exec>
<Command>msg</Command>
<Arguments>* ha</Arguments>
</Exec>
</Actions>
</Task>
Reproduce issue with:
powershell write-eventlog -logname system -source "eventlog" -eventID 4800 -entrytype Information -message "'Testmessage'"
Friday, April 26, 2019 6:55 AM | 1 vote
Hi,
Thank you for posting in our forum!
From your description about your issue, I’ve send a feedback to Microsoft. If we have any progress, we will let you know as soon as possible.
Thanks for your understanding again!
If you have any question, please feel free to let me know.
Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].
Thursday, May 30, 2019 6:45 PM
@ Moderator
I have confirmed this is a bug in Windows 2012 R2 (and therefore presumably Windows 8.1) as well.