# Task Scheduler trigger task when a Process Terminates

I'm trying to use Windows 10 Task Scheduler to create a task that is triggered when a particular process is terminated.

My first step was enabling Audit process tracking in the Group Policy Editor (Windows Settings > Security Settings > Local Policies > Audit Policy). This turns on event logging for whenever a processes start or stop. The termination (stop) event ID in Windows is 4689 (link). I can now see (in the Event Log) when processes are terminated, including the specific process I'm wanting to trigger an task on.

Next I attempted to create a task in Task Scheduler that will execute when this particular process is terminated. The particular application process name I want to watch for is C:\Program Files\path\to\my\application.exe.

I created a custom event filter for it and used the following XML:

<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">
*[System[(EventID="4689")]] and *[EventData[Data[@Name="ProcessName"]="C:\Program Files\path\to\my\application.exe"]]
</Select>
</Query>
</QueryList>


This doesn't seem to want to work though. I'm not sure what I'm doing wrong on the syntax. I don't get any errors or anything. My task simply doesn't get triggered.

• one thing you could try is using Microsoft-Windows-ProcessExitMonitor source. It would be interesting to know if it triggers. E.g. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\processtomonitor.exe] "GlobalFlag"=dword:00000200 – HelpingHand Jan 15 at 22:12

## 1 Answer

I'm wrestling with the very same thing, it's maddening. The Event Filter triggers on Process Creation (Task = 13312, EventID=4688) but NOT on Termination...

Set up same as OP, I also see the Creation and Termination events in Event Viewer, made a task to trigger a .bat on Process Termination (Task = 13313, EventID=4689) but the event does not trigger it. When I run the task manually it of course works. The filter goes like this:

<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">
*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and Task = 13313 and (band(Keywords,9007199254740992)) and (EventID=4689)]]
and
*[EventData[Data[@Name='NewProcessName'] and (Data='C:\Program Files\AppName.exe')]]
</Select>
</Query>
</QueryList>


What th am I missing here???

EDIT: Aha! I was missing this. Now it triggers on Terminate.

<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">
*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and (band(Keywords,9007199254740992)) and (EventID=4689)]]
and
*[EventData[(Data='C:\Program Files\AppName.exe')]]
</Select>
</Query>
</QueryList>

• The filter works the same both ways, doesn't care for Task nor ProcessName – mardus Feb 20 at 18:20
• What is band(Keywords,9007199254740992)? – Jake Wilson Feb 21 at 5:36