Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using Windows 7, and I want to make a scheduled task with my options using the Task Scheduler command-line mode utility that is called "SchTasks".

But there are some problems using Schtasks:

  1. Is there a way to add "on Workstation Unlock" trigger?
  2. Is there a way to add two or more triggers?

I want to have all the options on the command line like when I'm using the GUL Task Scheduler Application.

share|improve this question
up vote 6 down vote accepted

Option 1

Event ID 4801 corresponds to The workstation was unlocked. You can turn on logging for this event as I explain in my answer here.

Now you can use schtasks as follows to create the task triggered by this event:

schtasks /Create /RU "Username" /SC ONEVENT /MO "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4801]]" /EC Security /TN "Taskname" /TR "Drive:\path to\program.exe" /F

Here I've used the /EC parameter to define the Event Channel (in this case the Security log). The MO or Modifier parameter is used to specify the XPath filter required to match events we are interested in.

However, you might state that you can use an On workstation unlock trigger without needing to turn on logging for the event, and you would be correct of course. The available triggers for a task are as follows:


The ones I've marked in green can be specified using schtasks' /SC parameter:

/SC   schedule     Specifies the schedule frequency.
                   Valid schedule types: MINUTE, HOURLY, DAILY, WEEKLY,

The ones I've marked in red don't seem to have corresponding schtasks options. There may be an obscure way to create tasks using such triggers, but till date I haven't found it and am inclined to think that it's just not possible (the lack of easily understandable yet detailed documentation about schtasks' parameters doesn't help either).

There is a workaround of course, which leads us to (drum-roll please)...

Option 2

Simply create the task with the required triggers (more than one if you want) using the Task Scheduler UI and export it as an XML. Now of course you can import the XML on demand and recreate the task perfectly:

schtasks /Create /TN "Taskname" /XML "ExportedTask.xml"
share|improve this answer
Very useful. Tnx ! – Amirreza Nasiri Jul 5 '13 at 21:23
Option 2 is, in fact, awesome! – Peter Mortensen Dec 18 '15 at 8:29
schtasks /Delete /TN "Taskname" may be useful if repeating the command to create the task. – Peter Mortensen Jan 14 at 17:34

Instead of turning on auditing of the unlock event the following code will work as is.

schtasks /Create /SC ONEVENT /MO "*[System[(EventID=4624)]] and  *[EventData[Data[9]="7"]]" /EC Security /TN "PF9I" /TR "\"C:\Program Files\Five9PlantronicsInterface\MyApps.bat"\" /F

The trick lies in the fact that Data[9] corresponds to the property LogonType and the value of 7 corresponds to the unlock event.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.