Windows Task Scheduler: Backwards Incompatibility
Scheduled tasks are plentiful in most environments. Managing them is typically a nightmare. You have some running to truncate and copy off logs someplace, or others to run a proprietary backup utility to dump a copy of your Quickbooks data; whatever the reason, over time there are more and they are everywhere. Typically, you want to know that they exist, when they are scheduled to run, and most importantly who they are going to run as. (Look our for password expirations!)
Unless you have invested in an enterprise solution for tasks, you are using Windows Task Scheduler and have the tools included with the Windows OS to do the trick. This article is to point out two major snafus you may come across when attempting to manage scheduled tasks across your environment:
Using WMI class versus the task scheduler API and what effects it has.
New versions in Vista / Windows 7 / Windows 2008 that do not work with XP / 2003.
The first item is more for those who attempt scripting and programming to manage the tasks across machines in the environment. WMI has a class called Win32_Scheduledjob which does quite a bit for managing tasks. However, any tasks created with or modified by the task scheduler API (such as through the task scheduler GUI or schtasks.exe) will cause the tasks to no longer be managed by WMI. For example, if you create a task using schtasks.exe, this tasks will not be returned in a WMI query; or, if you create a task using WMI, but then modify it with the task scheduler GUI, it will also no longer turn up in WMI.
So, Win32_Schedulejob is not a great option and we go about our business using the GUI and schdtasks.exe. We move on to our second issue, which is the backwards incompatibility for those using Vista, Windows 7 or Windows 2008. For example, from my Windows 7 workstation, if I use schtasks.exe or the Task Schedule MMC snap-in, I can query, manipulate, create tasks on Vista, Windows 7 or Windows 2008. When I attempt to reach a Windows XP or Windows 2003 machine, I get Access Denied. Running the older XP version of schtasks.exe did not return errors when run against any version OS. This is painful. The solution is to run the management commands from an XP or 2003 machine, or to copy the schtasks.exe and schedsvc.dll files from those version into a directory on your Vista / Win7 machine and run it from there. See this screenshot using both versions of the tool from my Windows 7 workstation, querying a Windows XP machine. I printed the file version each time to show the newer copy fails with Access is Denied.
You may very well have proper access, but this Access Denied means you have a newer version of the tool.
This Technet article explains what is new in Task Scheduler 2.0 (Vista and above) compared to 1.0. There are many new features, but I would have liked to have a schtasks.exe and a MMC snap-in that was backwards compatible to manage older versions.
One last note is that .job files from XP/2003 are not compatible with the newer Task Scheduler 2.0 (xml format). I’ve seen that folks used the older schtasks.exe to dump the task information in table format, than use Excel to properly edit it to the valid xml format.
Related Posts:
- Regular or Decaf? Tool launched to combat COFEE
- Six Bulletins in Last Patch Tuesday of 2009
- OSSEC: Agentless…It’s good, but not good enough
- OSSEC: Agentless scripts
- OSSEC: Agentless to save the day
Filed Under: Administration • Tools
