I'm trying to use Windows 10 Task Scheduler to create a task that is triggered when a particular process is terminated.
My first step was enabling
Audit process tracking in the Group Policy Editor (
Windows Settings > Security Settings > Local Policies > Audit Policy). This turns on event logging for whenever a processes start or stop. The termination (stop) event ID in Windows is
4689 (link). I can now see (in the Event Log) when processes are terminated, including the specific process I'm wanting to trigger an task on.
Next I attempted to create a task in Task Scheduler that will execute when this particular process is terminated. The particular application process name I want to watch for is
I created a custom event filter for it and used the following XML:
<QueryList> <Query Id="0" Path="Security"> <Select Path="Security"> *[System[(EventID="4689")]] and *[EventData[Data[@Name="ProcessName"]="C:\Program Files\path\to\my\application.exe"]] </Select> </Query> </QueryList>
This doesn't seem to want to work though. I'm not sure what I'm doing wrong on the syntax. I don't get any errors or anything. My task simply doesn't get triggered.