1

I'm trying to use Windows 10 Task Scheduler to create a task that is triggered when a particular process is terminated.

My first step was enabling Audit process tracking in the Group Policy Editor (Windows Settings > Security Settings > Local Policies > Audit Policy). This turns on event logging for whenever a processes start or stop. The termination (stop) event ID in Windows is 4689 (link). I can now see (in the Event Log) when processes are terminated, including the specific process I'm wanting to trigger an task on.

Next I attempted to create a task in Task Scheduler that will execute when this particular process is terminated. The particular application process name I want to watch for is C:\Program Files\path\to\my\application.exe.

I created a custom event filter for it and used the following XML:

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">
      *[System[(EventID="4689")]] and *[EventData[Data[@Name="ProcessName"]="C:\Program Files\path\to\my\application.exe"]]
    </Select>
  </Query>
</QueryList>

This doesn't seem to want to work though. I'm not sure what I'm doing wrong on the syntax. I don't get any errors or anything. My task simply doesn't get triggered.

1
  • one thing you could try is using Microsoft-Windows-ProcessExitMonitor source. It would be interesting to know if it triggers. E.g. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\processtomonitor.exe] "GlobalFlag"=dword:00000200 – HelpingHand Jan 15 at 22:12
0

I'm wrestling with the very same thing, it's maddening. The Event Filter triggers on Process Creation (Task = 13312, EventID=4688) but NOT on Termination...

Set up same as OP, I also see the Creation and Termination events in Event Viewer, made a task to trigger a .bat on Process Termination (Task = 13313, EventID=4689) but the event does not trigger it. When I run the task manually it of course works. The filter goes like this:

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">
     *[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and Task = 13313 and (band(Keywords,9007199254740992)) and (EventID=4689)]]
   and 
     *[EventData[Data[@Name='NewProcessName'] and (Data='C:\Program Files\AppName.exe')]]
    </Select>
  </Query>
</QueryList>

What th am I missing here???

EDIT: Aha! I was missing this. Now it triggers on Terminate.

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">
     *[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and (band(Keywords,9007199254740992)) and (EventID=4689)]]
   and 
     *[EventData[(Data='C:\Program Files\AppName.exe')]]
    </Select>
  </Query>
</QueryList>
2
  • The filter works the same both ways, doesn't care for Task nor ProcessName – mardus Feb 20 at 18:20
  • What is band(Keywords,9007199254740992)? – Jake Wilson Feb 21 at 5:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.